registry / rc-image-crop / 1.0.5

rc-image-crop@1.0.5

rc-image-crop

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Rendering the Crop component performs an obfuscated remote licence-revocation check. The remote result can suppress the cropper and invoke document manipulation.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer renders the exported Crop component in a browser.

Impact

The endpoint operator can remotely disable the component in deployed consumer applications.

Mechanism

Obfuscated remote revocation kill switch.

Attack narrative

The package loads its obfuscated entrypoint when imported. When its React component is rendered, it verifies a baked-in or supplied licence and fetches a revocation list from a third-party endpoint. If that list marks the licence revoked, the component changes to an invalid state, performs an obfuscated document operation, and returns no cropper. This concealed remote kill switch is unrelated to ordinary image-cropping behavior and lets the endpoint operator alter deployed application behavior.

AI rationale

This is a concealed, remotely controlled kill switch in a browser component, protected by deliberate obfuscation. It has no install-time hook or secret harvesting, but the concrete remote disablement behavior warrants blocking.

Evidence

package.jsonindex.js

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

rc-image-crop@1.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code