registry / @feedmepos/mf-inventory-portal / 1.7.15-dev.3
@feedmepos/mf-inventory-portal@1.7.15-dev.3
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe credential and environment matches inspected are consistent with application token refresh and a generated compatibility shim. Because the declared @feedmepos/core dependency is unresolved, its runtime source remains unreviewed and the verdict is manual review.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Importing the package entrypoint may load its runtime dependencies.
Impact
The effect of that dependency remains unknown; no concrete harmful effect was confirmed.
Mechanism
The available dependency evidence could not resolve @feedmepos/core@2.14.40, so its behavior could not be inspected.
AI rationale
The credential and environment matches inspected are consistent with application token refresh and a generated compatibility shim. Because the declared @feedmepos/core dependency is unresolved, its runtime source remains unreviewed and the verdict is manual review.
Evidence
package.json
Decision evidence
public snapshotAI called this Manual Review at 88.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes the package through a Vue entrypoint that re-exports application components and stores.
- The flagged token refresh code posts a supplied token to the app API and uses the returned token for authentication.
- The Dart bundle contains a process compatibility shim and build environment metadata, with no credential values or outbound transfer in the inspected excerpts.
- The manifest declares @feedmepos/core@2.14.40, whose source could not be resolved in the available dependency evidence.
Evidence against
- The inspected source excerpts do not establish credential theft or another concrete attack.
- The unavailable dependency source leaves runtime behavior unresolved, so a clean verdict is not supported.
Behavioral surface
ChildProcessFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flagged · loading sourcedist/app-D8j93Oqu.jsView file
6var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f);
L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst...
L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,...
...
L129: usage: {
L130: body: "Cannot delete {subject} because it is linked in these items:",
L131: module: {
...
L7793: else {
L7794: if (n.charCodeAt(0) === 36)
L7795: throw new Error("Unknown operation " + n);
...
L8075: if (O && typeof O != "string")
L8076: throw new Error("Ability.can expects 3rd
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/app-D8j93Oqu.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-D8j93Oqu.js
L6: var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f);
L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst...
L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,...
...
L129: usage: {
L130: body: "Cannot delete {subject} because it is linked in these items:",
L131: module: {
...
L7793: else {
L7794: if (n.charCodeAt(0) === 36)
L7795: throw new Error("Unknown operation " + n);
...
L8075:
Findings
3 Critical2 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-D8j93Oqu.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-D8j93Oqu.js
CriticalPrevious Version Dangerous Deltadist/inventory-core-dart.default-BfVqWKxc.js
HighTrigger Reachable Credential Exfiltrationdist/app-D8j93Oqu.js
HighSemantic Analysis Limiteddist/app-D8j93Oqu.js
MediumNetwork
MediumOversized Source Filedist/app-D8j93Oqu.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.15-dev.3.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.15-dev.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.