registry / dccxx-s3-explorer / 1.0.182-hoaphat
dccxx-s3-explorer@1.0.182-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source does not substantiate the scanner's credential-exfiltration or phishing claims. The reviewed matches resolve to bundled identity support and application workflows, while the manifest's prepare and prepublishOnly scripts run Husky setup and a build.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consuming application loads a bundle and a user invokes sign-in, sharing, or sync features.
Impact
The inspected requests match those application features; no unauthorized credential transfer or other attack behavior was established.
Mechanism
Sign-in uses Microsoft identity endpoints; sync sends a bearer token to an API base derived from the current browser origin. Sharing uses a dedicated permissions service.
AI rationale
The source does not substantiate the scanner's credential-exfiltration or phishing claims. The reviewed matches resolve to bundled identity support and application workflows, while the manifest's prepare and prepublishOnly scripts run Husky setup and a build.
Evidence
package.jsondist/s3-explorer.jsdist/s3-explorer.umd.cjs
Network endpoints3
login.microsoftonline.coms3-explorer.cmcts1.studio.ai.vnhoaphat.cagent.cmcts.ai
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the two reviewed bundles; prepare runs Husky and prepublishOnly runs the build.
- The ES module API base defaults to the browser's current origin.
- SharePoint sync sends a bearer token to that API base for the sync endpoint.
- The UMD bundle has the same current-origin API base and sync pattern.
- The document-permission feature uses a dedicated default service and submits file permission data.
- The reviewed sign-in configuration uses Microsoft identity endpoints.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(fo,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ms.CLIENT_ERROR_RANGE_START&&e.status<=ms.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Io(e.error,e.error_description,e.suberror,e.timestamp||we.EMPTY_STRING,e.trace_id||we.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(fo,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ms.CLIENT_ERROR_RANGE_START&&e.status<=ms.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw $x(e.error,e.error_description,e.suberror)?new Io(e.error,e.error_description,e.suberror,e.tim
Findings
3 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.182-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.182-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.