registry / helpersutils-dev-tools / 1.0.11

helpersutils-dev-tools@1.0.11

Development utility helpers

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Loading the main entry in a browser makes an HTTP request that discloses the current page's domain to a remote IP. This behavior is unrelated to the stated helper package purpose.

Static reason

No blocking static signals were detected.

Trigger

A consumer loads or imports the package main entry in a browser-like environment.

Impact

Discloses the consumer's current website domain to a third-party endpoint.

Mechanism

Image request beacon carrying document.domain

Attack narrative

The package's browser-loaded main entry creates an Image and sets its source to a remote IP, appending the current document domain as a query value. This silently transmits site context whenever the entry is evaluated. A separate payload file duplicates the beacon.

Rationale

The package contains concrete, undisclosed network exfiltration behavior unrelated to its claimed development-helper purpose. Although it has no install hook, the runtime beacon is sufficient malicious behavior.

Evidence

index.jsbypass.jspackage.json

Network endpoints2

5.189.173.113:8899/csp-edu5.189.173.113:8899/csp

Decision evidence

public snapshot

with false-positive risk.

helpersutils-dev-tools@1.0.11

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code