registry / Credential exfiltration / vtlab-generic-functions
vtlab-generic-functions
This report shows the evidence for vtlab-generic-functions@1.0.45. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe runtime path automatically forwards potentially credential-bearing request data and response details to a fixed package-selected recipient. The optional global opt-out does not provide recipient-specific consent for that disclosure.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls an exported Axios helper to make a request.
Impact
Credentials and response data may be exposed to the queue operator without recipient-specific consent.
Mechanism
The helper logs request parameters and response details without redacting credentials, then sends the events to a fixed queue; logging can only be skipped through a global opt-out.
Attack narrative
Calling an exported Axios helper automatically logs the supplied request parameters, including caller-provided headers and config, then logs response headers, config, and data. The logger sends these events to a fixed SQS queue in AWS account 826419745875. Logging is active unless a global opt-out is set, and the source shows no credential redaction or recipient-specific destination guard.
AI rationale
The runtime path automatically forwards potentially credential-bearing request data and response details to a fixed package-selected recipient. The optional global opt-out does not provide recipient-specific consent for that disclosure.
Evidence
axios/index.jsaxios/logs.jscloudwatch/index.js
Network endpoints2
sqs.eu-west-1.amazonaws.com/826419745875/tookane_SQS_save_log_on_cloudwatch_DEVELOPsqs.eu-west-1.amazonaws.com/826419745875/tookane_SQS_save_log_on_cloudwatch
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The exported Axios helpers accept caller-supplied headers and config, which can contain authentication values.
- Each request automatically logs its parameters, and successful responses are logged with their headers, config, and data.
- Logging runs unless a global opt-out is set, then sends the log to CloudWatch.
- CloudWatch selects a fixed SQS queue in AWS account 826419745875 and sends each log event there.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourceftp/ftp-promise-wrapper.jsView file
45patternName = generic_password
severity = medium
line = 45
Medium
Secret Pattern
Package contains a possible secret pattern.
ftp/ftp-promise-wrapper.jsView on unpkg · L45axios/index.jsView file
22r 3rd party
'config': Joi.object().optional(), // this to config the axios
'headers': Joi.object().optional() // this to set/configure the headers like auth or anything
});
/**
* validate params against paramSchema
* @p
High
Ai Review Evidence
The exported Axios helpers accept caller-supplied headers and config, which can contain authentication values.
axios/index.jsView on unpkg · L22273}
}*/
return await post(url, params);
}
// export the request handler
module.exports = {
get,
post,
put,
patch,
deletion,
sendSoapRequest
};
High
Ai Review Evidence
Findings
4 High3 Medium5 Low
HighAi Review Evidenceaxios/index.js
HighAi Review Evidenceaxios/index.js
HighAi Review Evidenceaxios/index.js
HighAi Review Evidenceaxios/index.js
MediumSecret Patternftp/ftp-promise-wrapper.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to vtlab-generic-functions@1.0.45.
The versions list below shows the verdict for each recorded version.
- Avoid installing vtlab-generic-functions@1.0.45. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.