registry / Destructive action / rc-image-crop
rc-image-crop
rc-image-crop
This report shows the evidence for rc-image-crop@1.0.5, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concealed, remotely controlled kill switch in a browser component, protected by deliberate obfuscation. It has no install-time hook or secret harvesting, but the concrete remote disablement behavior warrants blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer renders the exported Crop component in a browser.
Impact
The endpoint operator can remotely disable the component in deployed consumer applications.
Mechanism
Obfuscated remote revocation kill switch.
Attack narrative
The package loads its obfuscated entrypoint when imported. When its React component is rendered, it verifies a baked-in or supplied licence and fetches a revocation list from a third-party endpoint. If that list marks the licence revoked, the component changes to an invalid state, performs an obfuscated document operation, and returns no cropper. This concealed remote kill switch is unrelated to ordinary image-cropping behavior and lets the endpoint operator alter deployed application behavior.
AI rationale
This is a concealed, remotely controlled kill switch in a browser component, protected by deliberate obfuscation. It has no install-time hook or secret harvesting, but the concrete remote disablement behavior warrants blocking.
Evidence
package.jsonindex.js
Network endpoints1
api.npoint.io/f63d2269d3d045f8cdc3
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package entrypoint is index.js.
- The entrypoint is deliberately string-table obfuscated, concealing its browser behavior.
- It contains a hard-coded remote revocation endpoint and fetches it when the component is used.
- A remote revocation result changes the component to invalid and enters a document-manipulation branch instead of rendering the cropper.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The inspected package contains no Node child-process, credential, or filesystem-harvesting code.
- The remote response is parsed as a revocation list, not executed as code.
Behavioral surface
Network
HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourceindex.jsView file
1const _0x5ee1eb=_0x59fd;(function(_0x4b6fd5,_0x4ea62d){const _0x1d9886=_0x59fd,_0x5ab713=_0x4b6fd5();while(!![]){try{const _0x5735f8=-parseInt(_0x1d9886(0x208))/0x1+parseInt(_0x1d9...
L2: * Checks if an event is supported in the current execution environment.
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.jsView on unpkg · L115function _0x59fd(_0x2f416b,_0x228cc9){_0x2f416b=_0x2f416b-0x1f0;const _0x11e4fd=_0x11e4();let _0x59fd4f=_0x11e4fd[_0x2f416b];return _0x59fd4f;}
High
Ai Review Evidence
The entrypoint is deliberately string-table obfuscated, concealing its browser behavior.
index.jsView on unpkg · L1515'https://api.npoint.io/f63d2269d3d045f8cdc3'
High
Ai Review Evidence
It contains a hard-coded remote revocation endpoint and fetches it when the component is used.
index.jsView on unpkg · L1515const _0x5085f0=await fetch(REVOKED_LIST_URL,{'cache':_0x5503d1(0x2a7),'signal':AbortSignal[_0x5503d1(0x257)](REVOCATION_FETCH_TIMEOUT_MS)});
Findings
6 High2 Medium4 Low
HighObfuscated Payload Loaderindex.js
HighObfuscated
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to rc-image-crop@1.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing rc-image-crop@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.