@feedmepos/mf-inventory-portal@1.7.5-dev.2
## Description
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection contradicts the malicious scanner label but confirms a published CI-environment artifact with import-time global mutation. Warn pending removal or rebuild without embedded environment data.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Application runtime import of a view that imports the Dart artifact.
Impact
Published build metadata is unnecessarily exposed and may interfere with host code.
Mechanism
Embedded CI environment disclosure and global process pollution.
AI rationale
Source inspection contradicts the malicious scanner label but confirms a published CI-environment artifact with import-time global mutation. Warn pending removal or rebuild without embedded environment data.
Evidence
package.jsondist/inventory-core-dart.default-B0kHPJ3I.jsdist/ReceiveRequestView-DucbkxwJ.jsdist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.js
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- dist/inventory-core-dart.default-B0kHPJ3I.js embeds a large build-time CI environment object.
- The artifact runs on module import and assigns its embedded object to globalThis.process.
- The added Dart artifact is imported by multiple runtime view chunks.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- No child-process, filesystem-harvesting, or network-request API is present in the Dart artifact.
- The bidi match in JsonViewer is a CodeMirror control-character regex, not concealed executable source.
Behavioral surface
ChildProcessFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcedist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.jsView file
9076contains invisible/control Unicode U+200B (zero width space)
- -<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF-]`, Tr), Nd = {
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.jsView on unpkg · L9076dist/app-D-nwdsYm.jsView file
•path = dist/app-D-nwdsYm.js
kind = oversized_source_file
sizeBytes = 4945230
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/app-D-nwdsYm.jsView on unpkgdist/inventory-core-dart.default-B0kHPJ3I.js
Findings
1 Critical1 High3 Medium6 Low
CriticalTrojan Source Unicodedist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.js
HighPrevious Version Dangerous Deltadist/inventory-core-dart.default-B0kHPJ3I.js
MediumNetwork
MediumOversized Source Filedist/app-D-nwdsYm.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.5-dev.2.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.5-dev.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.