registry / @feedmepos/mf-inventory-portal / 1.7.2-dev.2
@feedmepos/mf-inventory-portal@1.7.2-dev.2
## Description
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection shows a bundled Vue inventory portal with no install lifecycle hook, host-file access, shell execution, persistence, or remote payload loading. Scanner findings are explained by bundled JSZip/core-js/Dart artifacts and application-aligned backend calls.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User loads the inventory portal and performs authentication or inventory actions.
Impact
Expected application authentication and inventory data operations.
Mechanism
Browser-side requests to configured FeedMe backend services.
AI rationale
Source inspection shows a bundled Vue inventory portal with no install lifecycle hook, host-file access, shell execution, persistence, or remote payload loading. Scanner findings are explained by bundled JSZip/core-js/Dart artifacts and application-aligned backend calls.
Evidence
package.jsondist/app.jsdist/app-qwJVwq2l.jsdist/IntegrationExplorerView-DmVuoHPY.jsdist/inventory-core-dart.default-D3eNj5mW.jsdist/jszip.min-Da4KZ1Eo.jsdist/EmailDialog.vue_vue_type_script_setup_true_lang-B4_buziB.jsREADME.md
Network endpoints3
account.feedmedev.ccportal-v2-dev.feedmeapi.comportal-v2.feedmeapi.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Bundled CI environment snapshot appears in `dist/inventory-core-dart.default-D3eNj5mW.js`.
- `dist/jszip.min-Da4KZ1Eo.js` contains `new Function` in JSZip's setImmediate fallback.
Evidence against
- `package.json` has no preinstall, install, postinstall, or prepare hook.
- `dist/app.js` only re-exports Vue application modules.
- Dynamic imports in `dist/app-qwJVwq2l.js` reference local `./*.js` chunks.
- No shipped ESM import of Node filesystem, shell, or child-process APIs was found.
- Unicode hit is a core-js whitespace character set in `dist/EmailDialog.vue_vue_type_script_setup_true_lang-B4_buziB.js`.
- Network calls target declared FeedMe authentication and inventory backend flows.
Behavioral surface
ChildProcessEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flagged · loading sourcedist/jszip.min-Da4KZ1Eo.jsView file
2265}, d.setImmediate = function(x) {
L2266: typeof x != "function" && (x = new Function("" + x));
L2267: for (var E = new Array(arguments.length - 1), B = 0; B < E.length; B++) E[B] = arguments[B + 1];
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/jszip.min-Da4KZ1Eo.jsView on unpkg · L2265dist/IntegrationExplorerView-DmVuoHPY.jsView file
9157contains invisible/control Unicode U+200B (zero width space)
- -<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF-]`, oo), Dp = {
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/IntegrationExplorerView-DmVuoHPY.jsView on unpkg · L9157dist/app-qwJVwq2l.jsView file
Findings
1 Critical2 High2 Medium7 Low
CriticalTrojan Source Unicodedist/IntegrationExplorerView-DmVuoHPY.js
HighOversized Source Filedist/app-qwJVwq2l.js
HighPrevious Version Dangerous Deltadist/inventory-core-dart.default-D3eNj5mW.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/jszip.min-Da4KZ1Eo.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.2-dev.2.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.2-dev.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.