registry / @feedmepos/mf-inventory-portal / 1.7.21
@feedmepos/mf-inventory-portal@1.7.21
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe inspected credential flow is consistent with token refresh after an API authorization failure. The unresolved dependency source prevents a clean verdict because its install-time behavior could not be assessed.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Dependency installation may run lifecycle code from the unresolved dependency.
Impact
That dependency's install-time behavior remains unassessed.
Mechanism
The package manifest declares a dependency whose source was unavailable in this snapshot.
AI rationale
The inspected credential flow is consistent with token refresh after an API authorization failure. The unresolved dependency source prevents a clean verdict because its install-time behavior could not be assessed.
Evidence
package.json
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @feedmepos/core@2.14.40 as a dependency.
- The manifest's prepublish command runs build checks and build steps.
- The runtime sends a session token to the configured account service during token refresh.
- That refresh is called after an inventory API request returns HTTP 401.
- The inspected @feedmepos/mf-common source uses the same account service.
Evidence against
- The inspected token transfer is part of a 401 refresh flow, and the account endpoint also appears in the inspected FeedMe authentication dependency.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-DjHFIbGl.jsView file
30123var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30124: return new function(wt) {
L30125: var _t = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-DjHFIbGl.jsView on unpkg · L30123dist/app-HdbDnmIi.jsView file
6var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f);
L7: var ve = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst...
L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as tm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,...
...
L129: usage: {
L130: body: "Cannot delete {subject} because it is linked in these items:",
L131: module: {
...
L7842: else {
L7843: if (n.charCodeAt(0) === 36)
L7844: throw new Error("Unknown operation " + n);
...
L8124: if (w && typeof w != "string")
L8125: throw new Error("Ability.can expects 3rd
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-HdbDnmIi.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-HdbDnmIi.js
CriticalPrevious Version Dangerous Deltadist/inventory-core-dart.default-B9K5y5D7.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-DjHFIbGl.js
HighTrigger Reachable Credential Exfiltrationdist/app-HdbDnmIi.js
HighSemantic Analysis Limiteddist/app-HdbDnmIi.js
MediumNetwork
MediumOversized Source Filedist/app-HdbDnmIi.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.21.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.