/incidentsfield log

// npm 패키지

@boldreports/javascript-reporting-controls

The Bold Reports by Syncfusion controls for JavaScript contains ReportViewer and ReportDesigner HTML5 and JavaScript reporting controls for enterprise web development

npmjs.com tarball repo homepage

버전

271

메인테이너

3

라이선스

SEE LICENSE IN README.md

최초 publish

2019-10-29

publisher

bold-reports

tarball

83,872,598 B

AUTO-PUBLISHED·1개 버전 인덱싱됨·최근 publish: 2026-06-03

// exfil path

what is read → where it ships

steals

● Chromium logins
● Azure creds
○ clipboard

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> "url": "git+https://github.com/boldreports/javascript-reporting-controls.git"
> "url": "https://github.com/boldreports/javascript-reporting-controls/issues"
> "homepage": "https://boldreports.com"
> (function($,ej,undefined){ej.widget("boldReportViewer","ej.ReportViewer",{_rootCSS:"e-reportviewer",element:null,model:null,validTags:["div"],defaults:{reportServiceUrl:"",exportServiceUrl:"",reportSe…

→ view full payload

// offending code· @13.1.35· 3 files flagged

llm: malicious · 0.95

→ 크리덴셜 읽기 (reads-azure-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

@13.1.35·2026-06-03·AUTO-PUBLISHED·publisher: bold-reports
heuristic 60/100
static flags 7
llm malicious (0.95) via fast-track
new-publisher:7dhuge-tarball:80mbmature-packagehas-source-repopublisher-multi-name-burst:4public-github-pushreads-chromium-credsclipboard-accessreads-azure-credsfunction-constructorchild-process-spawnhttp-to-public-ip
→ 크리덴셜 읽기 (reads-azure-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.
// offending code· 3 files flaggedpatterns: 7

--- package/package.json (excerpt) ---
{
  "name": "@boldreports/javascript-reporting-controls",
  "version": "13.1.35",
  "description": "The Bold Reports by Syncfusion controls for JavaScript contains ReportViewer and ReportDesigner HTML5 and JavaScript reporting controls for enterprise web development",
  "repository": {
    "type": "git",
    "url": "git+https://github.com/boldreports/javascript-reporting-controls.git"
  },
  "keywords": [
    "Bold Reports",
    "Bold Report Viewer",
    "Bold Report Designer",
    "Report Viewer",
    "Report Designer",
    "Report Editor",
    "Report Builder",
    "SSRS",
    "HTML5 JavaScript Report Viewer",
    "JavaScript reporting controls",
    "Reporting Tools",
    "Syncfusion",
    "Export Reports",
    "RDL",
    "RDLC",
    "SSRS Report Viewer",
    "SSRS Report Designer"
  ],
  "author": "Syncfusion Inc",
  "license": "SEE LICENSE IN README.md",
  "dependencies": {
    "jquery": "*",
    "jquery-validation": "1.21.0",
    "jsrender": "*",
    "@boldreports/global": "13.1.35"
  },
  "bugs": {
    "url": "https://github.com/boldreports/javascript-reporting-controls/issues"
  },
  "homepage": "https://boldreports.com"
}


--- package/Scripts/v2.0/bold.report-viewer.min.js (excerpt) ---
/*!
*  filename: bold.report-viewer.min.js
*  version : 13.1.35
*  Copyright Syncfusion Inc. 2001 - 2026. All rights reserved.
*  Use of this code is subject to the terms of our license.
*  A copy of the current license can be obtained at any time by e-mailing
*  licensing@syncfusion.com. Any infringement will be prosecuted under
*  applicable laws. 
*/
(function($,ej,undefined){ej.widget("boldReportViewer","ej.ReportViewer",{_rootCSS:"e-reportviewer",element:null,model:null,validTags:["div"],defaults:{reportServiceUrl:"",exportServiceUrl:"",reportServerId:"",reportCacheID:"",serviceAuthorizationToken:"",accessToken:"",embedToken:"",reportViewerClientId:"",reportViewerId:"",reportPath:"",enableVirtualEvaluation:!1,enableCrossDomainCookies:!1,smartRendering:!1,renderClassicUI:!1,reportServerUrl:"",dataSources:[],parameters:[],extendedAttributes:{},exportSettings:{CommonOptions:{ImageQuality:2,UsePrintSizes:!1},PDFOptions:{EnableComplexScript:!1,PdfConformanceLevel:0,Security:{UserPassword:""}},ExcelOptions:{ExcelSaveType:4,ExcelSheetProtection:0,ReadOnlyRecommended:!1,DisableCellFormat:0,LayoutOption:0,PasswordToOpen:null,PasswordToModify:null,IncludeRawData:!1},WordOptions:{FormatType:2,ProtectionType:0,LayoutOption:0,ParagraphSpacing:{Top:1,Bottom:1},EncryptionPassword:null,ProtectionPassword:null},exportOptions:255,customItems:[],hideExportItemList:[],CsvOptions:{Qualifier:'"',FieldDelimiter:",",UseFormattedValues:!1},HTMLOptions:{HidePageSeparator:!1},PPTOptions:{

--- package/Scripts/v2.0/localization/reportviewer/ej.localetexts.en-NZ.min.js (excerpt) ---
/*!
*  filename: ej.localetexts.en-NZ.min.js
*  version : 13.1.35
*  Copyright Syncfusion Inc. 2001 - 2026. All rights reserved.
*  Use of this code is subject to the terms of our license.
*  A copy of the current license can be obtained at any time by e-mailing
*  licensing@syncfusion.com. Any infringement will be prosecuted under
*  applicable laws. 
*/
ejs.base.L10n.load({"en-NZ":{grid:{EmptyRecord:"No records to display",True:"true",False:"false",InvalidFilterMessage:"Invalid Filter Data",GroupDropArea:"Drag a column header here to group its column",UnGroup:"Click here to ungroup",GroupDisable:"Grouping is disabled for this column",FilterbarTitle:'"s filter bar cell',EmptyDataSourceError:"DataSource must not be empty at initial load since columns are generated from dataSource in AutoGenerate Column Grid",Add:"Add",Edit:"Edit",Cancel:"Cancel",Update:"Update",Delete:"Delete",Print:"Print",Pdfexport:"PDF Export",Excelexport:"Excel Export",Wordexport:"Word Export",Csvexport:"CSV Export",Search:"Search",Columnchooser:"Columns",Save:"Save",Item:"item",Items:"items",EditOperationAlert:"No records selected for edit operation",DeleteOperationAlert:"No records selected for delete operation",SaveButton:"Save",OKButton:"OK",CancelButton:"Cancel",EditFormTitle:"Details of ",AddFormTitle:"Add New Record",BatchSaveConfirm:"Are you sure you want to save changes?",BatchSaveLostChanges:"Unsaved changes will be lost. Are you sure you want to continue?",ConfirmDelete:"Are you sure y

{
  "name": "@boldreports/javascript-reporting-controls",
  "version": "13.1.35",
  "description": "The Bold Reports by Syncfusion controls for JavaScript contains ReportViewer and ReportDesigner HTML5 and JavaScript reporting controls for enterprise web development",
  "repository": {
    "type": "git",
    "url": "git+https://github.com/boldreports/javascript-reporting-controls.git"
  },
  "keywords": [
    "Bold Reports",
    "Bold Report Viewer",
    "Bold Report Designer",
    "Report Viewer",
    "Report Designer",
    "Report Editor",
    "Report Builder",
    "SSRS",
    "HTML5 JavaScript Report Viewer",
    "JavaScript reporting controls",
    "Reporting Tools",
    "Syncfusion",
    "Export Reports",
    "RDL",
    "RDLC",
    "SSRS Report Viewer",
    "SSRS Report Designer"
  ],
  "author": "Syncfusion Inc",
  "license": "SEE LICENSE IN README.md",
  "dependencies": {
    "jquery": "*",
    "jquery-validation": "1.21.0",
    "jsrender": "*",
    "@boldreports/global": "13.1.35"
  },
  "bugs": {
    "url": "https://github.com/boldreports/javascript-reporting-controls/issues"
  },
  "homepage": "https://boldreports.com"
}

/*!
*  filename: bold.report-viewer.min.js
*  version : 13.1.35
*  Copyright Syncfusion Inc. 2001 - 2026. All rights reserved.
*  Use of this code is subject to the terms of our license.
*  A copy of the current license can be obtained at any time by e-mailing
*  licensing@syncfusion.com. Any infringement will be prosecuted under
*  applicable laws. 
*/
(function($,ej,undefined){ej.widget("boldReportViewer","ej.ReportViewer",{_rootCSS:"e-reportviewer",element:null,model:null,validTags:["div"],defaults:{reportServiceUrl:"",exportServiceUrl:"",reportServerId:"",reportCacheID:"",serviceAuthorizationToken:"",accessToken:"",embedToken:"",reportViewerClientId:"",reportViewerId:"",reportPath:"",enableVirtualEvaluation:!1,enableCrossDomainCookies:!1,smartRendering:!1,renderClassicUI:!1,reportServerUrl:"",dataSources:[],parameters:[],extendedAttributes:{},exportSettings:{CommonOptions:{ImageQuality:2,UsePrintSizes:!1},PDFOptions:{EnableComplexScript:!1,PdfConformanceLevel:0,Security:{UserPassword:""}},ExcelOptions:{ExcelSaveType:4,ExcelSheetProtection:0,ReadOnlyRecommended:!1,DisableCellFormat:0,LayoutOption:0,PasswordToOpen:null,PasswordToModify:null,IncludeRawData:!1},WordOptions:{FormatType:2,ProtectionType:0,LayoutOption:0,ParagraphSpacing:{Top:1,Bottom:1},EncryptionPassword:null,ProtectionPassword:null},exportOptions:255,customItems:[],hideExportItemList:[],CsvOptions:{Qualifier:'"',FieldDelimiter:",",UseFormattedValues:!1},HTMLOptions:{HidePageSeparator:!1},PPTOptions:{

/*!
*  filename: ej.localetexts.en-NZ.min.js
*  version : 13.1.35
*  Copyright Syncfusion Inc. 2001 - 2026. All rights reserved.
*  Use of this code is subject to the terms of our license.
*  A copy of the current license can be obtained at any time by e-mailing
*  licensing@syncfusion.com. Any infringement will be prosecuted under
*  applicable laws. 
*/
ejs.base.L10n.load({"en-NZ":{grid:{EmptyRecord:"No records to display",True:"true",False:"false",InvalidFilterMessage:"Invalid Filter Data",GroupDropArea:"Drag a column header here to group its column",UnGroup:"Click here to ungroup",GroupDisable:"Grouping is disabled for this column",FilterbarTitle:'"s filter bar cell',EmptyDataSourceError:"DataSource must not be empty at initial load since columns are generated from dataSource in AutoGenerate Column Grid",Add:"Add",Edit:"Edit",Cancel:"Cancel",Update:"Update",Delete:"Delete",Print:"Print",Pdfexport:"PDF Export",Excelexport:"Excel Export",Wordexport:"Word Export",Csvexport:"CSV Export",Search:"Search",Columnchooser:"Columns",Save:"Save",Item:"item",Items:"items",EditOperationAlert:"No records selected for edit operation",DeleteOperationAlert:"No records selected for delete operation",SaveButton:"Save",OKButton:"OK",CancelButton:"Cancel",EditFormTitle:"Details of ",AddFormTitle:"Add New Record",BatchSaveConfirm:"Are you sure you want to save changes?",BatchSaveLostChanges:"Unsaved changes will be lost. Are you sure you want to continue?",ConfirmDelete:"Are you sure y

@boldreports/javascript-reporting-controls flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index