@feedmepos/mf-inventory-portal@1.8.0
## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe token exchange may support normal authentication, but it sends the current session token to a fixed host whose service relationship remains unverified. Treat this conditional credential exposure as a warning, not a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A protected API request returns HTTP 401 and the refresh helper runs.
Impact
The host receives the session token and could access it; source inspection does not establish how the host handles it.
Mechanism
The helper posts the session token to the host’s custom-token endpoint, then requests an ID token.
AI rationale
The token exchange may support normal authentication, but it sends the current session token to a fixed host whose service relationship remains unverified. Treat this conditional credential exposure as a warning, not a confirmed attack.
Evidence
dist/app.jsdist/app-VtVYHCDF.js
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Suspicious at 73.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports dist/app.js, which loads the runtime chunk containing the token-refresh code.
- The runtime posts the supplied token to a fixed authentication host; the transfer has no visible recipient-specific consent check.
- After a protected request receives an HTTP 401 response, the runtime passes the current session token to that refresh helper.
Evidence against
- The token transfer is part of an authentication refresh triggered by an HTTP 401 response.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-D8od7aKT.jsView file
30140var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30141: return new function(wt) {
L30142: var Nt = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-D8od7aKT.jsView on unpkg · L30140dist/app-VtVYHCDF.jsView file
6var Bu = ($, g, f) => HI($, typeof g != "symbol" ? g + "" : g, f), Ru = ($, g, f) => g.has($) || J_("Cannot " + f);
L7: var Ae = ($, g, f) => (Ru($, g, "read from private field"), f ? f.call($) : g.get($)), ht = ($, g, f) => g.has($) ? J_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as GI, ref as vi, shallowRef as YI, watchEffect as WI, computed as gn, h as j_, defineComponent as Qm, createBlock as QI, renderSlot as KI, createCommentVNode as ZI,...
...
L129: usage: {
L130: body: "{subject} is still used by the following items:",
L131: module: {
...
L10894: else {
L10895: if (n.charCodeAt(0) === 36)
L10896: throw new Error("Unknown operation " + n);
...
L11176: if (O && typeof O != "string")
L11177: throw new Error("Ability.can expects 3rd paramete
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-VtVYHCDF.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-VtVYHCDF.js
CriticalPrevious Version Dangerous Deltadist/feature-VDUlSvM1.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-D8od7aKT.js
HighTrigger Reachable Credential Exfiltrationdist/app-VtVYHCDF.js
HighSemantic Analysis Limiteddist/App-BPdZMhM8.js#virtual:string-array:round1
MediumNetwork
MediumOversized Source Filedist/app-VtVYHCDF.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.8.0.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.