sf-i-events@1.0.1162
Superflows Navigation Component
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe component sends session credentials to a publisher-selected endpoint during an admin action, but the source does not establish whether that endpoint is a trusted service backend. Warn for conditional credential exposure; the evidence does not support blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
An administrator clicks the calendar-mapping back button.
Impact
The email and access token may be disclosed to an unverified recipient; the inspected source does not show further credential use.
Mechanism
The component reads email and access-token cookies, builds Basic authorization, and passes it with project data to the fixed endpoint through its request helper.
AI rationale
The component sends session credentials to a publisher-selected endpoint during an admin action, but the source does not establish whether that endpoint is a trusted service backend. Warn for conditional credential exposure; the evidence does not support blocking.
Evidence
sf-i-events.jsutil.js
Network endpoints1
3mefupehxkw4pwsq3oyk7lf2pq0pisdx.lambda-url.us-east-1.on.aws
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package entrypoint is sf-i-events.js. The manifest shows no install hook.
- An admin interface click invokes the calendar request.
- The request sends project data and Basic authorization built from the email and access-token cookies to a fixed AWS Lambda URL.
- The shared request helper places supplied authorization in an HTTP Authorization header.
- Other mapped-calendar requests use the configured API host, leaving the fixed Lambda endpoint’s relationship to that service unclear.
Evidence against
- The Lambda request is behind an admin interface click, not package installation or import.
- The inspected source does not establish whether the Lambda endpoint is a trusted backend for this application or whether the credentials are misused.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcedev/templates/table-template.docxView file
•path = dev/templates/table-template.docx
kind = high_entropy_blob
sizeBytes = 5507
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dev/templates/table-template.docxView on unpkg•path = dev/templates/table-template.docx
kind = compressed_blob
sizeBytes = 5507
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
dev/templates/table-template.docxView on unpkg•path = dev/templates/table-template.docx
kind = nested_archive_needs_inspection
sizeBytes = 5507
magicHex = [redacted]
Low
Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dev/templates/table-template.docxView on unpkgFindings
2 High6 Medium4 Low
HighShips High Entropy Blobdev/templates/table-template.docx
HighNode Builtin Dependency Squatpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdev/templates/table-template.docx
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencesf-i-events.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectiondev/templates/table-template.docx
Affected versions and remediation
This report applies to sf-i-events@1.0.1162.
See all versions of sf-i-events for other recorded verdicts.
- Review the evidence and your use of sf-i-events@1.0.1162 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.