registry / @feedmepos/mf-inventory-portal / 1.7.12
@feedmepos/mf-inventory-portal@1.7.12
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged transfer is a fixed account-token exchange reached after an authenticated API returns 401, and the inspected source does not establish unrelated credential export. A complete clean decision is not supported because source for some declared registry dependencies is unavailable in this package snapshot.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Dependency installation or use of the exported browser module.
Impact
No impact is confirmed; behavior in the unavailable dependency source cannot be assessed.
Mechanism
The unresolved dependency source prevents assessment of its install and runtime behavior; the inspected token exchange is part of a 401-triggered authentication refresh.
AI rationale
The flagged transfer is a fixed account-token exchange reached after an authenticated API returns 401, and the inspected source does not establish unrelated credential export. A complete clean decision is not supported because source for some declared registry dependencies is unavailable in this package snapshot.
Evidence
package.jsondist/app.jsdist/app-DX9D1w8l.js
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Manual Review at 70.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exports a browser module and declares registry dependencies, including FeedMe packages.
- The exported module re-exports UI components from the main bundle.
- The main bundle exchanges the session token with a fixed account endpoint when refreshing authentication.
- The refresh call follows a 401 response to an authenticated API request.
Evidence against
- The inspected token transfer is part of a 401-triggered authentication refresh; the source does not establish export to an unrelated recipient.
- The package snapshot does not include source for every declared registry dependency, so their install and runtime behavior remains unverified.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-Bw3cyaZa.jsView file
30018var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30019: return new function(wt) {
L30020: var _t = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-Bw3cyaZa.jsView on unpkg · L30018dist/app-DX9D1w8l.jsView file
6var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || z_("Cannot " + f);
L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? z_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as q_, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,...
...
L40: usage: {
L41: body: "Cannot delete {subject} because it is linked in these items:",
L42: module: {
...
L6880: else {
L6881: if (n.charCodeAt(0) === 36)
L6882: throw new Error("Unknown operation " + n);
...
L7162: if (O && typeof O != "string")
L7163: throw new Error("Ability.can expects 3rd par
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-DX9D1w8l.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-DX9D1w8l.js
CriticalPrevious Version Dangerous Deltadist/inventory-core-dart.default-C8gA6YiZ.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-Bw3cyaZa.js
HighTrigger Reachable Credential Exfiltrationdist/app-DX9D1w8l.js
HighSemantic Analysis Limiteddist/app-DX9D1w8l.js
MediumNetwork
MediumOversized Source Filedist/app-DX9D1w8l.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.12.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.