sf-i-events@1.0.1160
Superflows Navigation Component
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe calendar flow forwards existing cookie credentials to a hardcoded endpoint without visible destination validation. This supports a warning for conditional credential exposure, but does not establish a malicious chain or justify blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
A user activates the calendar mapping button, which calls fetchCalendar.
Impact
The endpoint receives the cookie-derived credentials; exposure depends on the relationship between that endpoint and the account service.
Mechanism
The handler reads email and accessToken cookies, encodes them, and passes them to a shared helper that sends them in an Authorization header.
AI rationale
The calendar flow forwards existing cookie credentials to a hardcoded endpoint without visible destination validation. This supports a warning for conditional credential exposure, but does not establish a malicious chain or justify blocking.
Evidence
sf-i-events.jsutil.js
Network endpoints1
3mefupehxkw4pwsq3oyk7lf2pq0pisdx.lambda-url.us-east-1.on.aws/schedulegetcalendarjob
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The calendar handler reads the email and accessToken cookies and targets a hardcoded AWS Lambda URL.
- The shared request helper sends supplied authorization in an HTTP Authorization header.
- The request is triggered by a calendar button handler.
Evidence against
- The package is a browser navigation component and declares no install lifecycle scripts.
- The DOCX finding is binary and was not treated as evidence of malicious behavior.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcedev/templates/table-template.docxView file
•path = dev/templates/table-template.docx
kind = high_entropy_blob
sizeBytes = 5507
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dev/templates/table-template.docxView on unpkg•path = dev/templates/table-template.docx
kind = compressed_blob
sizeBytes = 5507
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
dev/templates/table-template.docxView on unpkg•path = dev/templates/table-template.docx
kind = nested_archive_needs_inspection
sizeBytes = 5507
magicHex = [redacted]
Low
Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dev/templates/table-template.docxView on unpkgFindings
2 High6 Medium4 Low
HighShips High Entropy Blobdev/templates/table-template.docx
HighNode Builtin Dependency Squatpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdev/templates/table-template.docx
MediumStructural Risk Force Deep Review
MediumAi Review Evidencesf-i-events.js
MediumStripped Provenance Metadatautil.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectiondev/templates/table-template.docx
Affected versions and remediation
This report applies to sf-i-events@1.0.1160.
See all versions of sf-i-events for other recorded verdicts.
- Review the evidence and your use of sf-i-events@1.0.1160 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.