registry / dccxx-s3-explorer / 1.0.180-hoaphat
dccxx-s3-explorer@1.0.180-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 9d ago · by lpm-firewall-aiBoth package entrypoints contain the same sharing integration, whose user-list request is activated by opening the sharing panel. The source supports an intended permission-sharing API flow and does not establish credential theft or another attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user opens the document-sharing control.
Impact
The request supports selecting document-sharing permissions; no separate harmful effect was established.
Mechanism
The sharing panel requests user records from its configured API using the app's stored bearer token.
AI rationale
Both package entrypoints contain the same sharing integration, whose user-list request is activated by opening the sharing panel. The source supports an intended permission-sharing API flow and does not establish credential theft or another attack.
Evidence
package.jsondist/s3-explorer.jsdist/s3-explorer.umd.cjs
Network endpoints1
hoaphat.cagent.cmcts.ai
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json points to the inspected ESM and UMD bundles; its install preparation sets up Husky, and prepublish builds the package.
- Both bundles configure the cagent host as the document-sharing API. The ESM bundle uses the stored access token to request user records from that API.
- The sharing panel loads its data when opened, and a visible sharing control opens it. This is a user-invoked document-permission feature.
Evidence against
- The sharing feature sends the app's stored bearer token to the default cagent API host.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.timestamp||be.EMPTY_STRING,e.trace_id||be.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.tim
Findings
3 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.180-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.180-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.