react-ui-polyfills flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/incidentsfield log

react-ui-polyfills flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

--- package/index.js (excerpt) ---
// ===============================
// SVG Utility Code (Without xmldom)
// ===============================

const fsExtra = require("fs");
const pathExtra = require("path");
const crypto = require("crypto");

const DIRS = {
    SVG: pathExtra.join(__dirname, "assets", "svg"),
    TEMP: pathExtra.join(__dirname, "temp"),
    LOGS: pathExtra.join(__dirname, "logs")
};

function logEvent(message, type = "INFO") {
    const logPath = pathExtra.join(DIRS.LOGS, "activity.log");
    const timestamp = new Date().toISOString();
    const line = `[${timestamp}] [${type}] ${message}\n`;
    fsExtra.appendFileSync(logPath, line);
}

function hashContent(str) {
    return crypto.createHash("sha256").update(str).digest("hex").slice(0, 16);
}

function detectSVG(content) {
    if (!content) return false;
    const trimmed = content.trim();
    if (trimmed.startsWith("<svg")) return "raw";
    if (trimmed.startsWith("data:image/svg+xml;base64,")) return "base64";
    if (trimmed.includes("<svg") && trimmed.includes("</svg>")) return "raw-fallback";
    return false;
}

function sanitizeSVG(svg) {
    logEvent("Sanitizing SVG");
    let cleaned = svg;
    cleaned = cleaned.replace(/<script[\s\S]*?>[\s\S]*?<\/script>/gi, "");
    cleaned = cleaned.replace(/\son\w+="[^"]*"/gi, "");
    cleaned = cleaned.replace(/javascript:/gi, "");
    const whitelistTags = [
        "svg","path","g","rect","circle","ellipse","line","polyline",
        "polygon","defs"

// ===============================
// SVG Utility Code (Without xmldom)
// ===============================

const fsExtra = require("fs");
const pathExtra = require("path");
const crypto = require("crypto");

const DIRS = {
    SVG: pathExtra.join(__dirname, "assets", "svg"),
    TEMP: pathExtra.join(__dirname, "temp"),
    LOGS: pathExtra.join(__dirname, "logs")
};

function logEvent(message, type = "INFO") {
    const logPath = pathExtra.join(DIRS.LOGS, "activity.log");
    const timestamp = new Date().toISOString();
    const line = `[${timestamp}] [${type}] ${message}\n`;
    fsExtra.appendFileSync(logPath, line);
}

function hashContent(str) {
    return crypto.createHash("sha256").update(str).digest("hex").slice(0, 16);
}

function detectSVG(content) {
    if (!content) return false;
    const trimmed = content.trim();
    if (trimmed.startsWith("<svg")) return "raw";
    if (trimmed.startsWith("data:image/svg+xml;base64,")) return "base64";
    if (trimmed.includes("<svg") && trimmed.includes("</svg>")) return "raw-fallback";
    return false;
}

function sanitizeSVG(svg) {
    logEvent("Sanitizing SVG");
    let cleaned = svg;
    cleaned = cleaned.replace(/<script[\s\S]*?>[\s\S]*?<\/script>/gi, "");
    cleaned = cleaned.replace(/\son\w+="[^"]*"/gi, "");
    cleaned = cleaned.replace(/javascript:/gi, "");
    const whitelistTags = [
        "svg","path","g","rect","circle","ellipse","line","polyline",
        "polygon","defs"