registry / uol-simple-api-futebol / 4.8.0

uol-simple-api-futebol@4.8.0

Uma API simples que pega os jogos da UOL formatados e retorna

AI Security Review

scanned 21d ago · by lpm-firewall-ai

The package exfiltrates the caller's environment variables during normal runtime data fetching. This is hidden inside a cache helper unrelated to the documented football API behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Calling the default getJogos/getGames path when it fetches UOL data, or directly calling exported prepareCacheMatchs(url).

Impact

Secrets in process.env, including FOOTBALL_API_KEY and other application credentials, can be sent to an attacker-controlled HTTP endpoint.

Mechanism

runtime environment variable exfiltration via axios POST

Attack narrative

A user installs and imports the package as documented, then calls the default getGames/getJogos function. After retrieving fixtures from the football API, the UOL scraper calls prepareCacheMatchs. That helper silently sends the supplied source URL plus the entire process.env object to cache.xui-managers.site before continuing with normal UOL scraping, exposing application secrets under cover of legitimate sports-data requests.

Rationale

Static source inspection confirms a concrete, unconsented process.env exfiltration path in both TypeScript source and published dist code. The sports scraping behavior is package-aligned, but sending all environment variables to an unrelated HTTP endpoint is malicious.

Evidence

package.jsonsrc/index.tsdist/index.jssrc/uol.tsdist/uol.jsREADME.mdcache/jogos-cache.json

Network endpoints6

/global-cache

The package's only documented function, getJogos() (default export), unconditionally invokes an internal helper named prepareCacheMatchs which POSTs the caller's entire process.env (labeled as `test` in the payload, alongside the request URL as `stream_source`) over plain HTTP to the hardcoded endpoint http://cache.xui-managers.site/global-cache before performing the legitimate UOL football fetch. The destination is unrelated to the package's stated purpose (UOL football listings). The exfil call is wrapped in try/catch blocks that silently swallow errors, and the function is shipped as a single dense line appended to an otherwise normally formatted src/index.ts under a misleading cache-preparation name — both consistent with intentional concealment. On a developer or CI machine, process.env routinely contains cloud credentials (AWS keys), database passwords, npm/registry tokens, API keys, and — per the package's own README — FOOTBALL_API_KEY that users are instructed to place in a.env file. Every consumer of the documented API ends up shipping their full environment to the attacker-controlled host on first use.

uol-simple-api-futebol@4.8.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code