registry / @feedmepos/mf-inventory-portal / 1.8.0-dev.1
@feedmepos/mf-inventory-portal@1.8.0-dev.1
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiStatic inspection confirms a session-token refresh exchange with a FeedMe-branded account host, but does not establish an attack. The declared @feedmepos/core dependency remained unresolved, preventing a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The refresh flow runs after an API request receives a 401 response.
Impact
The inspected source does not establish credential theft, but unresolved dependency source leaves runtime behavior incomplete.
Mechanism
The application sends the current session token to a fixed account host for token exchange.
AI rationale
Static inspection confirms a session-token refresh exchange with a FeedMe-branded account host, but does not establish an attack. The declared @feedmepos/core dependency remained unresolved, preventing a clean verdict.
Evidence
package.jsondist/app.jsdist/app-Cb5s4jMu.js
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package exports dist/app.js, which imports the flagged application bundle.
- On an API 401, the bundle passes the current session token to a refresh function and uses the returned token.
- The refresh function posts that token to account.feedmedev.cc for token exchange.
Evidence against
- The manifest declares @feedmepos/core, but its source was unresolved in the inspected dependency snapshot, leaving selected runtime code unverified.
- The refresh host shares the package’s FeedMe identity; the inspected code does not establish an unrelated recipient or credential theft.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-B7nBbxMo.jsView file
30018var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30019: return new function(wt) {
L30020: var _t = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-B7nBbxMo.jsView on unpkg · L30018dist/app-Cb5s4jMu.jsView file
6var Lu = ($, g, f) => zF($, typeof g != "symbol" ? g + "" : g, f), Bu = ($, g, f) => g.has($) || P_("Cannot " + f);
L7: var Ae = ($, g, f) => (Bu($, g, "read from private field"), f ? f.call($) : g.get($)), yt = ($, g, f) => g.has($) ? P_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as qF, ref as vi, shallowRef as HF, watchEffect as GF, computed as sn, h as x_, defineComponent as Gm, createBlock as YF, renderSlot as WF, createCommentVNode as QF,...
...
L129: usage: {
L130: body: "Cannot delete {subject} because it is linked in these items:",
L131: module: {
...
L10791: else {
L10792: if (n.charCodeAt(0) === 36)
L10793: throw new Error("Unknown operation " + n);
...
L11073: if (k && typeof k != "string")
L11074: throw new Error("Ability.can expects
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-Cb5s4jMu.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-Cb5s4jMu.js
CriticalPrevious Version Dangerous Deltadist/inventory-core-dart.default-DDRxXXnt.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-B7nBbxMo.js
HighTrigger Reachable Credential Exfiltrationdist/app-Cb5s4jMu.js
HighSemantic Analysis Limiteddist/app-Cb5s4jMu.js
MediumNetwork
MediumOversized Source Filedist/app-Cb5s4jMu.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.8.0-dev.1.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.8.0-dev.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.