registry / dccxx-s3-explorer / 1.0.179-hoaphat
dccxx-s3-explorer@1.0.179-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe lifecycle scripts shown are build and Husky setup tasks. The scanner’s metadata indicator matches bundled Microsoft authentication region discovery, while the inspected application login flow opens a URL returned by its API; no concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Region discovery in the bundled authentication library, or invocation of the SharePoint login flow.
Impact
No credential theft, unauthorized account action, or other attack was established from the inspected source.
Mechanism
The inspected metadata code performs region discovery; the SharePoint flow requests a login URL and opens it in a popup.
AI rationale
The lifecycle scripts shown are build and Husky setup tasks. The scanner’s metadata indicator matches bundled Microsoft authentication region discovery, while the inspected application login flow opens a URL returned by its API; no concrete malicious behavior was found.
Network endpoints1
169.254.169.254/metadata/instance/compute/location
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- The manifest’s prepare hook sets up Husky, and prepublishOnly runs the build.
- The application’s SharePoint flow requests a login URL from its API and opens that URL in a popup.
- The metadata endpoint appears in the bundled Microsoft authentication library’s region discovery code.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.timestamp||be.EMPTY_STRING,e.trace_id||be.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.tim
Findings
4 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
CriticalPrevious Version Dangerous Deltadist/s3-explorer.js
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.179-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.179-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.