registry / @feedmepos/mf-inventory-portal / 1.7.7-dev.1
@feedmepos/mf-inventory-portal@1.7.7-dev.1
## Description
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection found a browser microfrontend with normal service calls and no install-time or covert attack chain. Scanner Unicode and network findings are explained by bundled CodeMirror and application dependencies.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application runtime invokes authentication or feature-flag functionality.
Impact
Normal portal service communication; no concrete malicious impact established.
Mechanism
User-supplied token exchange and feature-flag requests.
AI rationale
Direct source inspection found a browser microfrontend with normal service calls and no install-time or covert attack chain. Scanner Unicode and network findings are explained by bundled CodeMirror and application dependencies.
Evidence
package.jsondist/app.jsdist/app-BbKv3F5q.jsdist/feature-COt8667u.jsdist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.jsdist/vue-i18n-CmD9ZGMc.js
Network endpoints3
account.feedmedev.ccedge.api.flagsmith.com/api/v1/realtime.flagsmith.com/
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/vue-i18n-CmD9ZGMc.js embeds CI environment metadata, but no secret-harvesting or transmission path was found.
Evidence against
- package.json has no preinstall/install/postinstall hooks or bin entrypoint.
- dist/app.js only re-exports application components and stores.
- dist/app-BbKv3F5q.js sends an explicitly supplied auth token only to the package-aligned account.feedmedev.cc endpoint.
- The Unicode controls in JsonViewer are a CodeMirror control-character detection regex, not hidden executable logic.
- No filesystem harvesting, child-process use, agent-control mutation, or remote payload execution was found.
Behavioral surface
ChildProcessFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
2 flagged · loading sourcedist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.jsView file
9076contains invisible/control Unicode U+200B (zero width space)
- -<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF-]`, Tr), Nd = {
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.jsView on unpkg · L9076dist/app-BbKv3F5q.jsView file
•path = dist/app-BbKv3F5q.js
kind = oversized_source_file
sizeBytes = 4991936
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/app-BbKv3F5q.jsView on unpkgFindings
1 Critical3 Medium6 Low
CriticalTrojan Source Unicodedist/JsonViewer.vue_vue_type_script_setup_true_lang-ig2zSXAB.js
MediumNetwork
MediumOversized Source Filedist/app-BbKv3F5q.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.7-dev.1.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.7-dev.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.