registry / rc-progressive-image / 2.0.6

rc-progressive-image@2.0.6

rc-progressive-image

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The obfuscated React component performs remote license revocation checks during component use. An invalid result can erase the consumer page body outside localhost.

Static reason

One or more suspicious static signals were detected.

Trigger

Rendering the ProgressiveImage component with an invalid or revoked license result.

Impact

Denial of service to the consumer web application and remote control over whether it renders.

Mechanism

Remote license enforcement followed by DOM replacement.

Attack narrative

A consumer that directly imports and renders the obfuscated component runs a signed-license check and requests a remote revocation list. If the license is invalid and the application is not on localhost, the component replaces the entire document body with an empty div. This hidden, remotely influenced application-disabling behavior is not part of a progressive-image component and is not disclosed by the package README.

AI rationale

The package embeds concealed remote license enforcement that can destroy a consumer application's visible DOM at runtime. This is concrete destructive behavior, despite the absence of install hooks or observed secret theft.

Evidence

index.jsdocument.bodyIndexedDB verify-cache

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

rc-progressive-image@2.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code