registry / mftsccs-browser / 2.1.240-beta

mftsccs-browser@2.1.240-beta

Full Pack of concept and connection system

AI Security Review

scanned 1h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time script copies a package-owned service worker bundle into the consumer app public directory. This is a real lifecycle/platform-extension risk, but source inspection did not show malicious exfiltration or remote code execution.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; runtime activation requires app service-worker use

Impact

Consumer project public/serviceWorker.bundle.js is overwritten; runtime service worker can observe failed fetch metadata and relay it to the app client

Mechanism

install-time service worker file copy plus runtime fetch/message handling

Rationale

The package performs unconsented install-time project mutation by writing a service worker asset, which warrants a warning. Static inspection did not find concrete malicious behavior such as credential exfiltration, destructive actions, persistence beyond the app-owned service worker asset, or remote payload execution.

Evidence

package.jsonscripts/postinstall.jsdist/serviceWorker.bundle.jsdist/main.bundle.jsREADME.mdpublic/serviceWorker.bundle.js

Network endpoints5

ai.freeschema.comdevai.freeschema.com/v1/get-frontend-anomaly-parameterslogdev.freeschema.comcdn.boomconcole.com/freeschema/www.google.com/recaptcha/api.js

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines postinstall: node ./scripts/postinstall.js
scripts/postinstall.js creates consuming project public/ and overwrites public/serviceWorker.bundle.js
dist/serviceWorker.bundle.js installs/activates a service worker and handles fetch/message events
service worker 401 handler posts request url, headers, and JSON body back to the client page

Evidence against

No child_process, shell execution, eval, native binary, or dynamic remote payload loading found
Network calls in dist are API/client configured or package-aligned defaults for freeschema/logging/recaptcha/CDN
No credential harvesting or exfiltration to attacker-controlled fixed endpoint confirmed
README documents optional service worker mode and backend/client URL configuration

Behavioral surface

Source

FilesystemNetwork

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.04 MB of source, external domains: ai.freeschema.com, cdn.boomconcole.com, logdev.freeschema.com

Source & flagged code

5 flagged

package.jsonView file

Lines 2-42json

2 "name": "mftsccs-browser",

3 "version": "2.1.240-beta",

4 "environment": "production",

5 "description": "Full Pack of concept and connection system",

6 "main": "dist/main.bundle.js",

7 "types": "dist/types/app.d.ts",

8 "files": [

9 "dist",

10 "scripts/postinstall.js",

11 "README.md",

12 "package.json"

13 ],

14 "scripts": {

15 "generate-autocomplete-metadata": "node ./scripts/generate-autocomplete-metadata.cjs",

16 "start": "npx webpack",

17 "dev": "webpack --env NODE_ENV=development --mode development",

18 "build": "webpack --config webpack.config.js",

19 "prebuild:wico": "npm run generate-autocomplete-metadata",

20 "build:wico": "webpack --config webpack.wico.config.js",

21 "postbuild:wico": "node ./scripts/create-wico-package.cjs",

22 "postinstall": "node ./scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "test": "jest"

24 },

25 "devDependencies": {

26 "@babel/core": "^7.25.2",

27 "@babel/plugin-transform-modules-commonjs": "^7.24.8",

28 "@babel/preset-env": "^7.25.4",

29 "@babel/preset-typescript": "^7.24.7",

30 "@types/jest": "^30.0.0",

31 "babel-jest": "^30.4.1",

32 "cross-fetch": "^4.0.0",

33 "jest": "^30.4.2",

34 "postcss": "^8.5.6",

35 "postcss-nested": "^7.0.2",

36 "ts-loader": "^9.5.1",

37 "typescript": "^5.3.2",

38 "webpack": "^5.89.0",

39 "webpack-cli": "^5.1.4"

40 },

41 "repository": {

42 "type": "git",

dist/types/Api/Signup.d.tsView file

Lines 2-62typescript

2import { SignupModel } from "../DataStructures/SignupModel";

3/**

4 * Registers a new user account on the backend server.

5 *

6 * Creates a new user with provided signup information including email, password,

7 * username, and profile details.

8 *

9 * @param signupModel - SignupModel object containing:

10 * - email: User's email address

dist/types/Api/Signin.d.tsView file

Lines 1-25typescript

1import { FreeschemaResponse } from "../DataStructures/Responses/StandardResponses";

2import { SigninModel } from "../DataStructures/SigninModel";

3/**

4 * Alternative sign-in function using SigninModel structure.

5 *

6 * Similar to LoginToBackend but returns FreeschemaResponse format and

7 * does NOT automatically store the token. You must manually handle the token.

8 *

9 *

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/types/Api/Signup.d.tsView file

22patternName = generic_password severity = medium line = 22 matchedText = * pass...23",

Medium

Secret Pattern

Hardcoded password in dist/types/Api/Signup.d.ts

dist/types/Api/Signup.d.tsView on unpkg · L22

55patternName = generic_password severity = medium line = 55 matchedText = * pass...ss",

Medium

Secret Pattern

Hardcoded password in dist/types/Api/Signup.d.ts

dist/types/Api/Signup.d.tsView on unpkg · L55

dist/types/Api/Signin.d.tsView file

16patternName = generic_password severity = medium line = 16 matchedText = * pass...123"

Medium

Secret Pattern

Hardcoded password in dist/types/Api/Signin.d.ts

dist/types/Api/Signin.d.tsView on unpkg · L16

Findings

1 High5 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumSecret Patterndist/types/Api/Signup.d.ts

MediumSecret Patterndist/types/Api/Signin.d.ts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 2-42json

2 "name": "mftsccs-browser",

3 "version": "2.1.240-beta",

4 "environment": "production",

5 "description": "Full Pack of concept and connection system",

6 "main": "dist/main.bundle.js",

7 "types": "dist/types/app.d.ts",

8 "files": [

9 "dist",

10 "scripts/postinstall.js",

11 "README.md",

12 "package.json"

13 ],

14 "scripts": {

15 "generate-autocomplete-metadata": "node ./scripts/generate-autocomplete-metadata.cjs",

16 "start": "npx webpack",

17 "dev": "webpack --env NODE_ENV=development --mode development",

18 "build": "webpack --config webpack.config.js",

19 "prebuild:wico": "npm run generate-autocomplete-metadata",

20 "build:wico": "webpack --config webpack.wico.config.js",

21 "postbuild:wico": "node ./scripts/create-wico-package.cjs",

22 "postinstall": "node ./scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "test": "jest"

24 },

25 "devDependencies": {

26 "@babel/core": "^7.25.2",

27 "@babel/plugin-transform-modules-commonjs": "^7.24.8",

28 "@babel/preset-env": "^7.25.4",

29 "@babel/preset-typescript": "^7.24.7",

30 "@types/jest": "^30.0.0",

31 "babel-jest": "^30.4.1",

32 "cross-fetch": "^4.0.0",

33 "jest": "^30.4.2",

34 "postcss": "^8.5.6",

35 "postcss-nested": "^7.0.2",

36 "ts-loader": "^9.5.1",

37 "typescript": "^5.3.2",

38 "webpack": "^5.89.0",

39 "webpack-cli": "^5.1.4"

40 },

41 "repository": {

42 "type": "git",

dist/types/Api/Signup.d.tsView file

Lines 2-62typescript

2import { SignupModel } from "../DataStructures/SignupModel";

3/**

4 * Registers a new user account on the backend server.

5 *

6 * Creates a new user with provided signup information including email, password,

7 * username, and profile details.

8 *

9 * @param signupModel - SignupModel object containing:

10 * - email: User's email address

dist/types/Api/Signin.d.tsView file

Lines 1-25typescript

1import { FreeschemaResponse } from "../DataStructures/Responses/StandardResponses";

2import { SigninModel } from "../DataStructures/SigninModel";

3/**

4 * Alternative sign-in function using SigninModel structure.

5 *

6 * Similar to LoginToBackend but returns FreeschemaResponse format and

7 * does NOT automatically store the token. You must manually handle the token.

8 *

9 *