Back to Results

4.2.0

Office Viewer

Name: Office Viewer
Author: cweijan

View word, excel, powerpoint files and using WYSIWYG editor for markdown.

Visualization Other

Rank#-5736

cweijanopenvsx1,888,056Sep 14, 2026, 03:56 PMRegistryHomepageGitHub

Created: 6 years ago
Last commit: 2 months ago

Security Findings

VSX beacon with execution-guardrail corroboration

MaliciousScanner

External beacon POST paired with a Russia-geofence / hidden-state guard

OWASP-AST01 OWASP-AST03

No tagged releases

Lineage

Repo ships no git tags and no GitHub releases — consumers cannot pin to stable, reviewable versions

Dynamic exec of remote content (VSX)

Scanner

Fetched content reaches a dynamic exec sink in resource/markdown/dist/js/mermaid/mermaid.min.js: fetch(

resource/markdown/dist/js/mermaid/mermaid.min.js

OWASP-AST06

Dynamic exec of remote content (VSX)

Scanner

Fetched content reaches a dynamic exec sink in out/node_modules/katex.js: fetch(

out/node_modules/katex.js

OWASP-AST06

Hardcoded secrets/API keys

Scanner

Secret Keyword: API K...****

resource/markdown/dist/js/i18n/en_US.js

OWASP-AST04

Hardcoded secrets/API keys2×

Scanner

Secret Keyword: LOCKE...****

Secret Keyword: file`...****

out/webview/assets/Excel-D6aePWpJ.js

OWASP-AST04

Hardcoded secrets/API keys2×

Scanner

Secret Keyword: Falsc...****

Secret Keyword: Diese...****

package.nls.de.json

OWASP-AST04

Hardcoded secrets/API keys2×

Scanner

Secret Keyword: Contr...****

Secret Keyword: Este ...****

package.nls.es.json

OWASP-AST04

Hardcoded secrets/API keys2×

Scanner

Secret Keyword: Mot d...****

Secret Keyword: Cette...****

package.nls.fr.json

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: Wrong...****

package.nls.json

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: Senha...****

package.nls.pt-br.json

OWASP-AST04

Hardcoded secrets/API keys6×

Scanner

Secret Keyword: API K...****

Secret Keyword: API 密...****

Secret Keyword: API 金...****

Secret Keyword: API キ...****

Secret Keyword: ****

Secret Keyword: API-к...****

resource/markdown/ai-i18n.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: API キ...****

resource/markdown/dist/js/i18n/ja_JP.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: ****

resource/markdown/dist/js/i18n/ko_KR.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: API-к...****

resource/markdown/dist/js/i18n/ru_RU.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: API 密...****

resource/markdown/dist/js/i18n/zh_CN.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: API 金...****

resource/markdown/dist/js/i18n/zh_TW.js

OWASP-AST04

Hardcoded secrets/API keys2×

Scanner

Secret Keyword: folde...****

Secret Keyword: ****

theme/material-icons.json

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: typea...****

out/node_modules/puppeteer-core.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: objec...****

out/webview/assets/button-0iH650lU.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: Mot d...****

out/webview/assets/index-by55SFPL.js

OWASP-AST04

Dangerous security bypass flags2×

Scanner

Bypass flag in content: --no-sandbox

Bypass flag in content: --trust

OWASP-AST06

Beacon exfiltration (homedir id + external POST)

Scanner

Beacon POSTs to external non-first-party host api.office-viewer.app in out/extension.js — not a configurable serverUrl / auth-endpoint login

out/extension.js

OWASP-AST03

Russia-locale execution guardrail

Scanner

Russia locale/timezone guard (ru_RU) next to an execution guard in resource/markdown/dist/index.min.js

resource/markdown/dist/index.min.js

OWASP-AST08

Russia-locale execution guardrail

Scanner

Russia locale/timezone guard (ru_RU) next to an execution guard in out/extension.js

out/extension.js

OWASP-AST08

Russia-locale execution guardrail

Scanner

Russia locale/timezone guard (ru_RU) next to an execution guard in out/extension.web.js

out/extension.web.js

OWASP-AST08

Suspicious outbound hosts16×

Scanner

Outbound URLs to non-allowlisted host(s): mozilla.github.io, scripts.sil.org, www.apple.com

Outbound URLs to non-allowlisted host(s): api.office-viewer.app, breeze.aimon.applicationinsights.io, feross.org, mths.be, stackoverflow.com, unix.stackexchange.com, www.plantuml.com

Outbound URLs to non-allowlisted host(s): chevrotain.io, engelschall.com, jquery.org, langium.org, lodash.com, openjsf.org, opensource.org, tldrlegal.com

Outbound URLs to non-allowlisted host(s): chromium.googlesource.com, googlechromelabs.github.io, pptr.dev, stackoverflow.com, yargs.js.org

Outbound URLs to non-allowlisted host(s): www.ibm.com

Outbound URLs to non-allowlisted host(s): chevrotain.io, d3js.org, dom.spec.whatwg.org, engelschall.com, html.spec.whatwg.org, jquery.org, langium.org, lodash.com

Outbound URLs to non-allowlisted host(s): database-client.com

Outbound URLs to non-allowlisted host(s): ns.adobe.com, www.xfa.org

Outbound URLs to non-allowlisted host(s): mths.be, purl.org, schemas.openxmlformats.org, stuk.github.io

Outbound URLs to non-allowlisted host(s): api.office-viewer.app, breeze.aimon.applicationinsights.io, docs.oasis-open.org, mozilla.github.io, openoffice.org, purl.oclc.org, purl.org, schemas.openxmlfo...

Outbound URLs to non-allowlisted host(s): rolldown.rs, schemas.openxmlformats.org, stuk.github.io

Outbound URLs to non-allowlisted host(s): fb.me

Outbound URLs to non-allowlisted host(s): img.youtube.com, schemas.openxmlformats.org, www.youtube.com

Outbound URLs to non-allowlisted host(s): database-client.com, office-viewer.app, prosemirror.net, purl.org, schemas.openxmlformats.org

Outbound URLs to non-allowlisted host(s): b3log.org, database-client.com, ld246.com, www.plantuml.com

Outbound URLs to non-allowlisted host(s): database-client.com, docxtemplater.com, purl.oclc.org, schemas.openxmlformats.org, stuk.github.io

OWASP-AST01