mfm-widget-newer@15.7.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

mfm-widget-newer@15.7.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/chunks/widget-BOh3ubDn.jsView file

•Browser cookie sent to a fixed external endpoint in dist/chunks/widget-BOh3ubDn.js: */var nh;function Rv(){if(nh)return wt;nh=1;var n=ku();function o(b){var h="https://react.dev/errors/"+b;if(1<arguments.length){h+="?args[]="+encodeURIComponent(arguments[1]);for(v... */var ih;function Lv(){if(ih)return Bi;ih=1;var n=Nv(),o=ku(),a=oh();function l(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(argum... `+i.stack}}var $r=Object.prototype.hasOwnProperty,jr=n.unstable_scheduleCallback,Vr=n.unstable_cancelCallback,fa=n.unstable_shouldYield,ga=n.unstable_requestPaint,xt=n.unstable_now... `).replace(H1,"")}function gm(e,t){return t=fm(t),fm(e)===t}function $e(e,t,r,i,s,c){switch(r){case"children":typeof i=="string"?t==="body"||t==="textarea"&&i===""|

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunks/widget-BOh3ubDn.jsView on unpkg

59jt={baseUrl:"https://api.mockforme.com",clientProxyPath:"/mockforme",dashboardUrl:"https://dashboard.mockforme.com"}

Medium

Ai Review Evidence

The widget uses a fixed MockForMe API host; its authenticated proxy requests send the token provided to the widget to that same service.

dist/chunks/widget-BOh3ubDn.jsView on unpkg · L59

328async function Cd(n,o,a){const l=`${jt.baseUrl}${jt.clientProxyPath}${o}`;try{const d=await fetch(l,{method:"POST",headers:{"Content-Type":"application/json",mockforme:n},body:JSON.stringify(a)})

Medium

Ai Review Evidence

The widget uses a fixed MockForMe API host; its authenticated proxy requests send the token provided to the widget to that same service.

dist/chunks/widget-BOh3ubDn.jsView on unpkg · L328

328`:"",";",""),children:[u("div",{css:f("display:flex;justify-content:flex-end;padding:",p.spacing.xs," ",p.spacing.sm,";border-bottom:1px solid ",p.color.border,";background:",p.col... L329: `:return"Enter";default:return"Unidentified"}}function vE(n,o,a=o){const l={...Ir(),key:o,code:a};n.dispatchEvent(new KeyboardEvent("keydown",l)),n.dispatchEvent(new KeyboardEvent(... L330: 0% { transform: translateX(-100%) scaleX(0.4); }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/widget-BOh3ubDn.jsView on unpkg · L328

dist/chunks/JsonEditorLazyBundle-DbaaRrEN.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/JsonEditorLazyBundle-DbaaRrEN.jsView on unpkg

package.jsonView file

1{ "name": "mfm-widget-newer", "version": "15.7.0", "type": "module", "description": "mfm-w", "main": "./dist/mfm-widget-new.es.js", "module": "./dist/mfm-widget-new.es.js", "types": "./dist/widget.d.ts", "exports": { ".": { "types": "./dist/widget.d.ts", "import": "./dist/mfm-widget-new.es.js" } }, "files": [ "dist" ] }

Medium

Suspicious Lifecycle Evidence

The manifest contains only browser import entrypoints and no lifecycle scripts.

package.jsonView on unpkg · L1

Source & flagged code

6 flagged

dist/chunks/widget-BOh3ubDn.jsView file

•Browser cookie sent to a fixed external endpoint in dist/chunks/widget-BOh3ubDn.js: */var nh;function Rv(){if(nh)return wt;nh=1;var n=ku();function o(b){var h="https://react.dev/errors/"+b;if(1<arguments.length){h+="?args[]="+encodeURIComponent(arguments[1]);for(v... */var ih;function Lv(){if(ih)return Bi;ih=1;var n=Nv(),o=ku(),a=oh();function l(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(argum... `+i.stack}}var $r=Object.prototype.hasOwnProperty,jr=n.unstable_scheduleCallback,Vr=n.unstable_cancelCallback,fa=n.unstable_shouldYield,ga=n.unstable_requestPaint,xt=n.unstable_now... `).replace(H1,"")}function gm(e,t){return t=fm(t),fm(e)===t}function $e(e,t,r,i,s,c){switch(r){case"children":typeof i=="string"?t==="body"||t==="textarea"&&i===""|

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunks/widget-BOh3ubDn.jsView on unpkg

59jt={baseUrl:"https://api.mockforme.com",clientProxyPath:"/mockforme",dashboardUrl:"https://dashboard.mockforme.com"}

Medium

Ai Review Evidence

The widget uses a fixed MockForMe API host; its authenticated proxy requests send the token provided to the widget to that same service.

dist/chunks/widget-BOh3ubDn.jsView on unpkg · L59

328async function Cd(n,o,a){const l=`${jt.baseUrl}${jt.clientProxyPath}${o}`;try{const d=await fetch(l,{method:"POST",headers:{"Content-Type":"application/json",mockforme:n},body:JSON.stringify(a)})

Medium

Ai Review Evidence

The widget uses a fixed MockForMe API host; its authenticated proxy requests send the token provided to the widget to that same service.

dist/chunks/widget-BOh3ubDn.jsView on unpkg · L328

328`:"",";",""),children:[u("div",{css:f("display:flex;justify-content:flex-end;padding:",p.spacing.xs," ",p.spacing.sm,";border-bottom:1px solid ",p.color.border,";background:",p.col... L329: `:return"Enter";default:return"Unidentified"}}function vE(n,o,a=o){const l={...Ir(),key:o,code:a};n.dispatchEvent(new KeyboardEvent("keydown",l)),n.dispatchEvent(new KeyboardEvent(... L330: 0% { transform: translateX(-100%) scaleX(0.4); }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/widget-BOh3ubDn.jsView on unpkg · L328

dist/chunks/JsonEditorLazyBundle-DbaaRrEN.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/JsonEditorLazyBundle-DbaaRrEN.jsView on unpkg

package.jsonView file

Lines 1-18json

1{

2 "name": "mfm-widget-newer",

3 "version": "15.7.0",

4 "type": "module",

5 "description": "mfm-w",

6