registry / Destructive action / rc-twitter-embed
rc-twitter-embed
Lightweight, license-gated React component for embedding a Twitter/X timeline
This report shows the evidence for rc-twitter-embed@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete destructive browser behavior hidden inside an ostensibly lightweight embedding component. It is reachable during normal component use and lacks transparent documentation or user consent.
Static reason
One or more suspicious static signals were detected.
Trigger
A browser mounts TwitterTimelineEmbed with an absent or invalid licence key.
Impact
The package can destroy the consumer application's rendered page and make the component remotely disableable.
Mechanism
Remote licence revocation followed by DOM body replacement.
Attack narrative
The documented timeline component contains concealed licence code not described in its README. When mounted, it validates a licence, contacts a third-party endpoint for revocations, and on failure creates a replacement element and replaces the document body. This grants the publisher a remote switch that can disable or overwrite an importing application's page.
AI rationale
This is concrete destructive browser behavior hidden inside an ostensibly lightweight embedding component. It is reachable during normal component use and lacks transparent documentation or user consent.
Evidence
index.mjspackage.json
Network endpoints1
api.npoint.io/f63d2269d3d045f8cdc3
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The ESM entrypoint is deliberately obfuscated, concealing its runtime behavior.
- The package claims MIT licensing but includes an undocumented remote licence-revocation system.
- On component use, it fetches and decodes a remote revocation list.
- An invalid licence can replace the consumer page body with a newly created element.
Evidence against
- package.json has no install lifecycle hooks.
- The manifest declares React as a peer dependency and no Node-side dependencies.
Behavioral surface
DynamicRequire
HighEntropyStringsMinifiedTrivialUrlStrings
Source & flagged code
8 flagged · loading sourceindex.jsView file
1'use strict';function c(b,d){b=b-0x173;const e=a();let f=e[b];if(c['eVepkw']===undefined){var g=function(j){const l='[redacted]+...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.jsView on unpkg · L11'use strict';function c(b,d){b=b-0x173;const e=a();let f=e[b];if(c['eVepkw']===undefined){var g=function(j){const l='[redacted]+...
Medium
index.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.js#virtual:normalized:round1Findings
7 High2 Medium2 Low
HighObfuscated Payload Loaderindex.js
HighSemantic Analysis Limitedindex.js#virtual:normalized:round1
HighAi Review Evidenceindex.mjs
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.mjs
HighAi Review Evidenceindex.mjs
HighAi Review Evidenceindex.mjs
MediumDynamic Requireindex.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rc-twitter-embed@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing rc-twitter-embed@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.