registry / dccxx-s3-explorer / 1.0.181-hoaphat
dccxx-s3-explorer@1.0.181-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe inspected bundles show application API requests routed to the current origin, while the metadata lookup belongs to MSAL region discovery and Basic authorization is derived from request configuration. The manifest has no ordinary-install lifecycle hook that performs the flagged behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Normal application requests and MSAL region discovery.
Impact
No malicious credential disclosure or other attack impact was established.
Mechanism
Requests use the current browser origin; MSAL's metadata lookup is for Azure region discovery.
AI rationale
The inspected bundles show application API requests routed to the current origin, while the metadata lookup belongs to MSAL region discovery and Basic authorization is derived from request configuration. The manifest has no ordinary-install lifecycle hook that performs the flagged behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs Husky in prepare and a build in prepublishOnly; it defines no preinstall, install, or postinstall hook.
- The module bundle sets its API base to the current browser origin with an application path.
- Axios builds Basic authorization from request configuration; the app interceptor adds stored username and user ID to requests and limits its API key to named application endpoints.
- The flagged metadata address is used by MSAL region discovery, and the UMD bundle includes the app's configured document-service API endpoint.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.timestamp||we.EMPTY_STRING,e.trace_id||we.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.tim
Findings
3 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.181-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.181-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.