lasha-ctf-poc@1.0.2
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe runtime code exposes readable page cookies through a POST body, but its relative destination is the current site's route and no external recipient is shown. This is a conditional credential exposure risk, not evidence of an install-time attack.
Static reason
No blocking static signals were detected.
Trigger
Execution of index.js in a browser page.
Impact
The site's /addPost handler receives the cookie value as submitted content.
Mechanism
The script serializes document.cookie into a JSON content field and posts it to a relative route.
AI rationale
The runtime code exposes readable page cookies through a POST body, but its relative destination is the current site's route and no external recipient is shown. This is a conditional credential exposure risk, not evidence of an install-time attack.
Evidence
index.js
Network endpoints1
/addPost
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest points to index.js and defines no install lifecycle hook, so the behavior is tied to runtime execution.
- The entrypoint sends document.cookie in a POST body to the current site's /addPost route.
Evidence against
- The manifest has no install lifecycle hook, and the source does not identify an external recipient.
Behavioral surface
Network
Trivial
Source & flagged code
2 flaggedpackage.jsonView file
5"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC"
}
Medium
Suspicious Lifecycle Evidence
The manifest points to index.js and defines no install lifecycle hook, so the behavior is tied to runtime execution.
package.jsonView on unpkg · L5index.jsView file
1fetch('/addPost', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({content: 'EXFIL:' + document.cookie})
});
Medium
Ai Review Evidence
The entrypoint sends document.cookie in a POST body to the current site's /addPost route.
index.jsView on unpkg · L1Findings
3 Medium1 Low
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.js
LowScripts Present
Affected versions and remediation
This report applies to lasha-ctf-poc@1.0.2.
See all versions of lasha-ctf-poc for other recorded verdicts.
- Review the evidence and your use of lasha-ctf-poc@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.