registry / @feedmepos/mf-inventory-portal / 1.8.0-dev.10
@feedmepos/mf-inventory-portal@1.8.0-dev.10
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged token requests and dynamic Function call have ordinary authentication and core-js explanations in the inspected source. Declared runtime dependencies with unavailable source remain unresolved, so the package requires manual review.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A consumer imports the package entrypoint and its runtime dependencies load.
Impact
The available source does not establish credential theft or another attack, but the unresolved dependencies prevent a clean verdict.
Mechanism
The inspected package code performs application authentication and license API requests; unresolved dependency source prevents a complete assessment.
AI rationale
The flagged token requests and dynamic Function call have ordinary authentication and core-js explanations in the inspected source. Declared runtime dependencies with unavailable source remain unresolved, so the package requires manual review.
Evidence
package.json
Network endpoints2
account.feedmedev.cclicense-v2-dev.feedmeapi.com
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package entrypoint exports browser application components, and its scripts show build and publishing tasks rather than install hooks.
- The inspected token exchange is activated after an API response of 401 and sends the current session token to the account token service.
- The feature code sends session tokens to the FeedMe license API for feature and quota requests.
- The reported environment values appear in a static build environment object; no send path for that object was established.
- The flagged Function call is a core-js global-object fallback, not evaluation of supplied code.
Evidence against
- The manifest declares runtime dependencies whose source was unavailable in the inspection snapshot, leaving their behavior unresolved.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-Ce6Ly9pT.jsView file
30030var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30031: return new function(wt) {
L30032: var Nt = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-Ce6Ly9pT.jsView on unpkg · L30030dist/app-OztWApio.jsView file
6var Bu = ($, g, f) => HF($, typeof g != "symbol" ? g + "" : g, f), Ru = ($, g, f) => g.has($) || N_("Cannot " + f);
L7: var Ae = ($, g, f) => (Ru($, g, "read from private field"), f ? f.call($) : g.get($)), ht = ($, g, f) => g.has($) ? N_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as GF, ref as vi, shallowRef as YF, watchEffect as WF, computed as gn, h as J_, defineComponent as Qm, createBlock as QF, renderSlot as KF, createCommentVNode as ZF,...
...
L129: usage: {
L130: body: "Cannot delete {subject} because it is linked in these items:",
L131: module: {
...
L10743: else {
L10744: if (n.charCodeAt(0) === 36)
L10745: throw new Error("Unknown operation " + n);
...
L11025: if (k && typeof k != "string")
L11026: throw new Error("Ability.can expects
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-OztWApio.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-OztWApio.js
CriticalPrevious Version Dangerous Deltadist/feature-BUVZ_ab3.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-Ce6Ly9pT.js
HighTrigger Reachable Credential Exfiltrationdist/app-OztWApio.js
HighSemantic Analysis Limiteddist/App-BjFIh5km.js#virtual:string-array:round1
MediumNetwork
MediumOversized Source Filedist/app-OztWApio.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.8.0-dev.10.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.8.0-dev.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.