registry / feed-widget-helper / 1.0.4

feed-widget-helper@1.0.4

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The published main file runs on import: it reads a flag-like value from /profile and POSTs it to /addPost. That is scrape-and-exfiltrate behavior, not a feed widget. There is no install-time hook.

Static reason

No blocking static signals were detected.

Trigger

Importing or bundling index.js, especially in a browser on a site that serves /profile and /addPost.

Impact

Profile page content is copied into a new post on the same origin.

Mechanism

Import-time scrape of profile HTML and POST of the flag text

Attack narrative

When this module is imported or bundled, it immediately requests /profile, parses a .flag-value node, and POSTs that text to /addPost. The package does not export a helper API, and the name feed-widget-helper does not match this behavior. In a browser on a site that has those routes, that leaks profile content into a new post. There are no install lifecycle scripts, but the main entry is itself the payload.

AI rationale

index.js is an import-time scrape-and-post payload that copies .flag-value from /profile to /addPost, which does not match a feed widget helper. That is concrete data theft even though there are no install hooks or third-party hosts.

Evidence

index.js

Network endpoints2

/profile/addPost

Decision evidence

public snapshot

with false-positive risk.

feed-widget-helper@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code