registry / Data exfiltration / proto-plugin
proto-plugin
Shared framework for building shareable UI prototypes in Next.js — review shell, comment anchoring, variant exploration, and the prototype home gallery.
This report shows the evidence for proto-plugin@0.1.61. 5 of 22 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiConcrete default telemetry exfiltration to a package-controlled external store is established by source, and is compounded by unconsented postinstall host mutation. Scanner similarity labels were not relied on.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Install runs postinstall; rendering the plugin site triggers page and interaction telemetry.
Impact
Unconsented collection of user/company identifiers, routes, prototype metadata, and interaction events; host project mutation at install time.
Mechanism
Embedded external Redis sink receives implicit telemetry through package-provided API routes.
Attack narrative
On host-page rendering, the package wraps its UI in a telemetry provider that records route, interaction properties, persistent browser identifiers, and workspace user/company names. It posts these to a package route, which unconditionally stores valid events in Redis using a credential embedded in the published package, rather than host-provided telemetry configuration. The postinstall hook additionally writes a design-system route, copies a logo, and modifies host package scripts.
AI rationale
Concrete default telemetry exfiltration to a package-controlled external store is established by source, and is compounded by unconsented postinstall host mutation. Scanner similarity labels were not relied on.
Evidence
package.jsonscripts/ensure-design-system-page.mjsscripts/ensure-bootstrap-verify-scripts.mjssrc/config/prototype-site-layout-client.tsxsrc/lib/prototypes/telemetry/prototype-telemetry-context.tsxsrc/server/redis/client.tssrc/lib/prototypes/telemetry/prototype-telemetry-client.tssrc/server/prototype-telemetry-route.tssrc/server/redis/prototype-telemetry.ts
Network endpoints1
poetic-martin-83530.upstash.io
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- src/server/redis/client.ts embeds a non-env Upstash credential and endpoint.
- Telemetry is enabled by default around gallery and prototype routes.
- Client telemetry includes route, slug, persistent IDs, workspace user and company names.
- Telemetry POST is stored in the embedded Upstash Redis sink.
- postinstall creates host files and rewrites host package.json scripts.
Evidence against
- Telemetry browser target is a same-host relative API route, not a direct external URL.
- GitHub and npm requests are feature-bound routes, not payload delivery.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/ensure-design-system-page.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/lib/prototypes/telemetry/prototype-telemetry-context.tsxView file
•Automatic page telemetry attaches persistent client, session, user, and company identity before storage in a package-controlled external service with embedded credentials.
[redacted]-telemetry-context.tsx:
useEffect,
getTelemetryClientId,
getTelemetrySessionId,
clientId: getTelemetryClientId(),
sessionId: getTelemetrySessionId(),
userName: currentProfile.userName || undefined,
companyName: currentProfile.companyName || undefined,
useEffect(() => {
src/server/redis/prototype-telemetry.ts:
import { getDedicatedRedis, getDedicatedRedisStatus } from "./client";
export const PROTOTYPE_TELEMETRY_KEY = "prototype-telemetry:events";
export const PROTOTYPE_TELEMETRY_KNOWN_PROTOTYPES_KEY =
"prototype-telemetry:known-prototypes";
export function getTelemetryRedis(): Redis {
return getDedicatedRedis()
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
src/lib/prototypes/telemetry/prototype-telemetry-context.tsxView on unpkgscripts/publish-package.shView file
•path = scripts/publish-package.sh
kind = build_helper
sizeBytes = 7275
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/publish-package.shView on unpkgsrc/server/pr-vercel-preview-route.tsView file
•matchType = normalized_sha256
matchedPackage = proto-plugin@0.1.41
matchedPath = src/server/pr-vercel-preview-route.ts
matchedIdentity = npm:cHJvdG8tcGx1Z2lu:0.1.41
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/server/pr-vercel-preview-route.tsView on unpkgsrc/lib/prototype-comments/core/source-location.tsView file
•matchType = normalized_sha256
matchedPackage = proto-plugin@0.1.41
matchedPath = src/lib/prototype-comments/core/source-location.ts
matchedIdentity = npm:cHJvdG8tcGx1Z2lu:0.1.41
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/lib/prototype-comments/core/source-location.tsView on unpkgscripts/lib/component-library-coverage.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = proto-plugin@0.1.44
matchedIdentity = npm:cHJvdG8tcGx1Z2lu:0.1.44
similarity = 0.608
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/lib/component-library-coverage.mjsView on unpkgFindings
1 Critical4 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/lib/prototypes/telemetry/prototype-telemetry-context.tsx
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritysrc/server/pr-vercel-preview-route.ts
HighKnown Malware Source Similaritysrc/lib/prototype-comments/core/source-location.ts
HighPrevious Version Dangerous Deltascripts/lib/component-library-coverage.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/publish-package.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to proto-plugin@0.1.61.
The versions list below shows the verdict for each recorded version.
- Avoid installing proto-plugin@0.1.61. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
22 known versions0.1.61latestshownMaliciousData ExfiltrationBlockPublishedAug 5, 2026, 9:24 PM0.1.44Suspicious—WarnPublishedJul 18, 2026, 10:25 PM0.1.43Clean—AllowPublishedJul 18, 2026, 10:17 PM0.1.42Suspicious—WarnPublishedJul 18, 2026, 7:53 PM0.1.41MaliciousData ExfiltrationBlockPublishedJul 18, 2026, 7:33 PM0.1.40Suspicious—WarnPublishedJul 18, 2026, 4:06 PM0.1.36Suspicious—WarnPublishedJul 18, 2026, 6:38 AM0.1.34Suspicious—WarnPublishedJul 18, 2026, 6:04 AM0.1.32Suspicious—WarnPublishedJul 18, 2026, 5:49 AM0.1.31Suspicious—WarnPublishedJul 18, 2026, 5:39 AM0.1.30Suspicious—WarnPublishedJul 18, 2026, 5:24 AM0.1.29MaliciousData ExfiltrationBlockPublishedJul 18, 2026, 5:06 AM0.1.27Suspicious—WarnPublishedJul 18, 2026, 4:53 AM0.1.25Suspicious—WarnPublishedJul 18, 2026, 4:40 AM0.1.23MaliciousData ExfiltrationBlockPublishedJul 18, 2026, 4:26 AM0.1.21Suspicious—WarnPublishedJul 18, 2026, 4:18 AM0.1.20MaliciousData ExfiltrationBlockPublishedJul 18, 2026, 3:47 AM0.1.19SuspiciousAgent extension lifecycle riskWarnPublishedJul 18, 2026, 3:11 AM0.1.18SuspiciousData ExfiltrationWarnPublishedJul 17, 2026, 10:44 PM0.1.17Suspicious—WarnPublishedJul 14, 2026, 7:41 PM0.1.11Suspicious—WarnPublishedJul 10, 2026, 11:47 PM0.1.10Suspicious—WarnPublishedJul 8, 2026, 2:46 AM