@feedmepos/mf-inventory-portal@1.7.19
## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe active API retry path sends the current session token to a fixed development account endpoint, despite related configuration selecting the account host by environment. Because this is a vendor account domain and the source does not show hostile use, I classify it as a warning for conditional credential exposure, not as confirmed malware.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A backend request returns HTTP 401 and a retry remains available.
Impact
The session token reaches the development account environment; unauthorized use is not established by the inspected source.
Mechanism
The retry flow posts the current session token to the fixed development account host for token exchange.
AI rationale
The active API retry path sends the current session token to a fixed development account endpoint, despite related configuration selecting the account host by environment. Because this is a vendor account domain and the source does not show hostile use, I classify it as a warning for conditional credential exposure, not as confirmed malware.
Evidence
dist/app-D9ST2B25.jsdist/app.jspackage.json.lpm-dependency-evidence-e27e19bf-20cc-4acf-8816-b7ec6faee271/0/npm-linux/dist/app-8d59935f.js
Network endpoints2
account.feedmedev.cc/api/token/customaccount.feedmedev.cc/api/token/idtoken
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exports dist/app.js, which imports the flagged application bundle.
- The API client sends the current session token as a bearer token with requests.
- When a request returns HTTP 401, the client passes the current session token to refreshAuth before retrying.
- refreshAuth posts that token to a fixed account host in the development environment, then posts the returned custom token to the same host for an ID token.
- The shared account configuration selects a production or development host based on environment, while this refresh flow uses the development host directly.
Evidence against
- The fixed host is the vendor's account service domain, and the related shared configuration also uses it for development; source does not establish hostile use or an unrelated recipient.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-Bur_4RgG.jsView file
30123var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30124: return new function(wt) {
L30125: var _t = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-Bur_4RgG.jsView on unpkg · L30123dist/app-D9ST2B25.jsView file
6var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || z_("Cannot " + f);
L7: var be = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? z_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as Dh, ref as vi, shallowRef as Rh, watchEffect as Bh, computed as un, h as q_, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,...
...
L129: usage: {
L130: body: "Cannot delete {subject} because it is linked in these items:",
L131: module: {
...
L7841: else {
L7842: if (n.charCodeAt(0) === 36)
L7843: throw new Error("Unknown operation " + n);
...
L8123: if (O && typeof O != "string")
L8124: throw new Error("Ability.can expects 3rd
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-D9ST2B25.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-D9ST2B25.js
CriticalPrevious Version Dangerous Deltadist/inventory-core-dart.default-Dj6GfoJs.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-Bur_4RgG.js
HighTrigger Reachable Credential Exfiltrationdist/app-D9ST2B25.js
HighSemantic Analysis Limiteddist/app-D9ST2B25.js
MediumNetwork
MediumOversized Source Filedist/app-D9ST2B25.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.19.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.