registry / @feedmepos/mf-inventory-portal / 1.7.2-dev.0
@feedmepos/mf-inventory-portal@1.7.2-dev.0
## Description
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged Unicode is part of CodeMirror's control-character detection regex, and the network/dynamic-import findings are package-aligned frontend behavior. Direct inspection found no concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application runtime navigation or an authenticated SSE subscription.
Impact
No install-time execution, host-file access, credential harvesting, exfiltration, persistence, or remote payload execution found.
Mechanism
Fixed local chunk loading plus configured browser API and SSE requests.
AI rationale
The flagged Unicode is part of CodeMirror's control-character detection regex, and the network/dynamic-import findings are package-aligned frontend behavior. Direct inspection found no concrete malicious chain.
Evidence
package.jsondist/app.jsdist/app-D_Ym25tG.jsdist/useSseClient-Bl-WWwFk.jsdist/IntegrationExplorerView-ClhCRTC-.jsREADME.md
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- dist/app-D_Ym25tG.js embeds build-time CI environment metadata, but no secret-harvesting or transmission path was found.
Evidence against
- package.json has no preinstall, install, postinstall, bin, or native entrypoint.
- dist/app.js is a static Vue module export entrypoint with no import-time side effects.
- dist/IntegrationExplorerView-ClhCRTC-.js contains a CodeMirror control-character regex; its bidi characters are regex data, not deceptive source control flow.
- dist/app-D_Ym25tG.js dynamic imports use fixed local chunk paths for application routes.
- dist/useSseClient-Bl-WWwFk.js adds a session bearer token only to caller-configured SSE subscriptions.
Behavioral surface
ChildProcessEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
2 flagged · loading sourcedist/IntegrationExplorerView-ClhCRTC-.jsView file
9157contains invisible/control Unicode U+200B (zero width space)
- -<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF-]`, oo), Dp = {
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/IntegrationExplorerView-ClhCRTC-.jsView on unpkg · L9157dist/app-D_Ym25tG.jsView file
•path = dist/app-D_Ym25tG.js
kind = oversized_source_file
sizeBytes = 4952209
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/app-D_Ym25tG.jsView on unpkgFindings
1 Critical1 High2 Medium7 Low
CriticalTrojan Source Unicodedist/IntegrationExplorerView-ClhCRTC-.js
HighOversized Source Filedist/app-D_Ym25tG.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.2-dev.0.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.2-dev.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.