registry / Data exfiltration / proto-plugin
proto-plugin
Shared framework for building shareable UI prototypes in Next.js — review shell, comment anchoring, variant exploration, and the prototype home gallery.
This report shows the evidence for proto-plugin@0.1.61. 5 of 22 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiConcrete default telemetry exfiltration to a package-controlled external store is established by source, and is compounded by unconsented postinstall host mutation. Scanner similarity labels were not relied on.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Install runs postinstall; rendering the plugin site triggers page and interaction telemetry.
Impact
Unconsented collection of user/company identifiers, routes, prototype metadata, and interaction events; host project mutation at install time.
Mechanism
Embedded external Redis sink receives implicit telemetry through package-provided API routes.
Attack narrative
On host-page rendering, the package wraps its UI in a telemetry provider that records route, interaction properties, persistent browser identifiers, and workspace user/company names. It posts these to a package route, which unconditionally stores valid events in Redis using a credential embedded in the published package, rather than host-provided telemetry configuration. The postinstall hook additionally writes a design-system route, copies a logo, and modifies host package scripts.
AI rationale
Concrete default telemetry exfiltration to a package-controlled external store is established by source, and is compounded by unconsented postinstall host mutation. Scanner similarity labels were not relied on.
Evidence
package.jsonscripts/ensure-design-system-page.mjsscripts/ensure-bootstrap-verify-scripts.mjssrc/config/prototype-site-layout-client.tsxsrc/lib/prototypes/telemetry/prototype-telemetry-context.tsxsrc/server/redis/client.tssrc/lib/prototypes/telemetry/prototype-telemetry-client.tssrc/server/prototype-telemetry-route.tssrc/server/redis/prototype-telemetry.ts
Network endpoints1
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- src/server/redis/client.ts embeds a non-env Upstash credential and endpoint.
- Telemetry is enabled by default around gallery and prototype routes.
- Client telemetry includes route, slug, persistent IDs, workspace user and company names.
- Telemetry POST is stored in the embedded Upstash Redis sink.
- postinstall creates host files and rewrites host package.json scripts.
Evidence against
- Telemetry browser target is a same-host relative API route, not a direct external URL.
- GitHub and npm requests are feature-bound routes, not payload delivery.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/ensure-design-system-page.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/lib/prototypes/telemetry/prototype-telemetry-context.tsxView file
•Automatic page telemetry attaches persistent client, session, user, and company identity before storage in a package-controlled external service with embedded credentials.
[redacted]-telemetry-context.tsx:
useEffect,
getTelemetryClientId,
getTelemetrySessionId,
clientId: getTelemetryClientId(),
sessionId: getTelemetrySessionId(),
userName: currentProfile.userName || undefined,
companyName: currentProfile.companyName || undefined,
useEffect(() => {
src/server/redis/prototype-telemetry.ts:
import { getDedicatedRedis, getDedicatedRedisStatus } from "./client";
export const PROTOTYPE_TELEMETRY_KEY = "prototype-telemetry:events";
export const PROTOTYPE_TELEMETRY_KNOWN_PROTOTYPES_KEY =
"prototype-telemetry:known-prototypes";
export function getTelemetryRedis(): Redis {
return getDedicatedRedis()
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
Findings
1 Critical4 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/lib/prototypes/telemetry/prototype-telemetry-context.tsx
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritysrc/server/pr-vercel-preview-route.ts
HighKnown Malware Source Similaritysrc/lib/prototype-comments/core/source-location.ts
HighPrevious Version Dangerous Deltascripts/lib/component-library-coverage.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/publish-package.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to proto-plugin@0.1.61.
The versions list below shows the verdict for each recorded version.
- Avoid installing proto-plugin@0.1.61. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.