registry / react-photo-frame / 3.0.6

react-photo-frame@3.0.6

Give it a frame design and a photo, and it draws the photo inside the frame's border on a canvas, then hands back the combined image as a data URL.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A rendered component performs a remote licence-revocation check and can erase the host application's document body. This behavior is hidden in obfuscated source and is unrelated to drawing a photo frame.

Static reason

One or more suspicious static signals were detected.

Trigger

Render the PhotoFrame component with an invalid or remotely revoked licence on a non-localhost site.

Impact

The host web application is removed from the page.

Mechanism

Remote revocation check followed by document-body replacement.

Attack narrative

Importing and rendering the component starts licence verification. For a signed licence, the code obtains a remote revocation list and caches the result. If verification returns invalid and the hostname is not localhost, the component replaces the document's existing body with a new empty body. The endpoint can therefore remotely cause deployed consumer applications using the component to disappear.

Rationale

The package hides a remotely controlled kill switch in a photo-frame component and destroys the consumer page when its remote licence decision is negative. There is no install-time execution, but the concrete runtime destructive behavior warrants blocking.

Evidence

index.jsdocument.documentElement

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

react-photo-frame@3.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code