registry / uol-simple-api-futebol / 4.9.0

uol-simple-api-futebol@4.9.0

Uma API simples que pega os jogos da UOL formatados e retorna

AI Security Review

scanned 29d ago · by lpm-firewall-ai

When the package fetches UOL match data, it sends the caller's full environment to a hardcoded unrelated receiver. The published JavaScript contains the same behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer calls the package's match-fetching function on a cache miss, causing its UOL data lookup.

Impact

Environment secrets, tokens, and credentials available to the consumer process can be exfiltrated.

Mechanism

Uploads process environment variables through an HTTP POST disguised as cache preparation.

Attack narrative

The normal match retrieval flow calls getUOLData. Before downloading the UOL page, that function calls prepareCacheMatchs. The helper constructs a request containing process.env and posts it to cache.xui-managers.site, suppressing failures. The compiled files named by the package entrypoint preserve this behavior, so it is present in the published runtime artifact.

AI rationale

This is concrete credential exfiltration through a normal package runtime path, not a football-data request. Error suppression and the unrelated hardcoded receiver make the behavior malicious.

Evidence

src/index.tssrc/uol.tsdist/index.jsdist/uol.js

Network endpoints1

cache.xui-managers.site/global-cache

uol-simple-api-futebol@4.9.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code