registry / iban-validator-js / 1.0.2

iban-validator-js@1.0.2

An IBAN Validator, converting the IBAN into an integer and performing a mod-97 operation.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

An unreferenced browser script performs an account-takeover workflow against Teknosa. It runs automatically if t.js is executed in an authenticated browser session.

Static reason

No blocking static signals were detected.

Trigger

Execution of t.js in a logged-in Teknosa browser session, with attacker-supplied phone and SMS verification values.

Impact

The victim account's recovery phone number can be changed, enabling password-reset takeover.

Mechanism

Authenticated CSRF-token collection followed by phone-number change requests.

Attack narrative

The package contains t.js, a standalone browser attack script. On execution it reads CSRF and customer identifiers from the authenticated account page, asks for an attacker phone number and verification code, and sends authenticated requests to set that phone number. The script explicitly describes using the changed number for password recovery. Although it is not the package entry point and has no lifecycle hook, it is concrete account-takeover code shipped in the package.

AI rationale

The public library entry is benign, but the included t.js contains an executable, targeted account-takeover workflow. Its lack of automatic npm execution reduces exposure but does not neutralize the malicious payload.

Evidence

t.js

Network endpoints4

www.teknosa.com/hesabim/uyelik-bilgilerimwww.teknosa.com/hesabim/sendPhoneValidationwww.teknosa.com/hesabim/update-phone-validation/hesabim/set-phone-number

iban-validator-js@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code