registry / feed-widget-helper / 1.0.1

feed-widget-helper@1.0.1

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Importing the package immediately GETs /profile and POSTs that response body to /addPost on the same origin. There is no helper API and no install-time hook.

Static reason

No blocking static signals were detected.

Trigger

Importing or requiring the package main module index.js at runtime.

Impact

If this module loads in a web app that exposes those routes, profile text can be published as a post without an explicit call.

Mechanism

Import-time same-origin profile fetch posted as new content

AI rationale

The main module performs unsolicited import-time network side effects by copying /profile into a POST to /addPost, which is not a normal callable helper. There are no install hooks or third-party hosts, so this is unresolved dual-use risk rather than a proven malware dropper.

Evidence

index.js

Network endpoints2

/profile/addPost

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The main module runs fetch('/profile') as soon as it is loaded, with no exported function a caller would invoke.

feed-widget-helper@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code