registry / dccxx-s3-explorer / 1.0.178-hoaphat
dccxx-s3-explorer@1.0.178-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe bundles implement browser-based cloud storage flows, with token forwarding tied to a same-origin OneDrive-to-S3 sync action. The manifest has no install hook, and the scanner’s metadata match is conditionally gated MSAL behavior rather than evidence of credential theft.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Authentication and storage synchronization are initiated through the app’s user-facing flows.
Impact
No unrelated credential disclosure or malicious install-time behavior was established.
Mechanism
The metadata probe requires an Azure region auto-detection option that the app configuration does not set. The sync handler sends the OneDrive token to the page-origin API under /s3-explorer.
AI rationale
The bundles implement browser-based cloud storage flows, with token forwarding tied to a same-origin OneDrive-to-S3 sync action. The manifest has no install hook, and the scanner’s metadata match is conditionally gated MSAL behavior rather than evidence of credential theft.
Evidence
package.jsondist/s3-explorer.jsdist/s3-explorer.umd.cjs
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest uses Husky for prepare and runs a build for prepublishOnly; it declares no install hook.
- Both bundles configure Microsoft authentication for the app’s SharePoint or OneDrive flow.
- The app opens a backend-provided SharePoint login URL in a popup.
- The OneDrive sync handler sends its token to the same-origin storage API as part of a sync action.
- MSAL’s metadata probe requires Azure region auto-detection, which the app’s configuration does not enable.
- Both bundles resolve their default API base to the page origin under /s3-explorer.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw xx(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.timestamp||ye.EMPTY_STRING,e.trace_id||ye.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw xx(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.tim
Findings
4 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
CriticalPrevious Version Dangerous Deltadist/s3-explorer.js
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.178-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.178-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.