registry / @feedmepos/mf-inventory-portal / 1.8.0-dev.2
@feedmepos/mf-inventory-portal@1.8.0-dev.2
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged token flow is a fixed-host authentication refresh, and the flagged Function call is a bundled global-object fallback; neither established an attack. Several declared registry dependencies could not be resolved from inspected source, so the package needs manual review before a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Importing the package loads its exported portal bundle; authentication refresh runs after a service request returns 401.
Impact
No malicious impact was established; unresolved dependency behavior prevents a clean determination.
Mechanism
The inspected refresh code posts a session token to the fixed account.feedmedev.cc host. Other declared dependencies could not be reviewed from source.
AI rationale
The flagged token flow is a fixed-host authentication refresh, and the flagged Function call is a bundled global-object fallback; neither established an attack. Several declared registry dependencies could not be resolved from inspected source, so the package needs manual review before a clean verdict.
Evidence
package.jsondist/app.jsdist/app-yvK__CBL.jsdist/EmailDialog.vue_vue_type_script_setup_true_lang-H4FWc9ga.js
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package entrypoint reexports the inventory portal bundle.
- The bundle sends the session token to a fixed account.feedmedev.cc endpoint during authentication refresh after a 401 response.
- The flagged Function call is a global-object fallback in bundled code; no attacker-controlled code string was identified.
- The manifest declares additional Feedme registry dependencies whose runtime behavior could not be resolved from the inspected source.
Evidence against
- No concrete credential theft, unrelated recipient, or other attack behavior was confirmed in the inspected paths.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-H4FWc9ga.jsView file
30013var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30014: return new function(wt) {
L30015: var _t = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-H4FWc9ga.jsView on unpkg · L30013dist/app-yvK__CBL.jsView file
6var Lu = ($, g, f) => zF($, typeof g != "symbol" ? g + "" : g, f), Bu = ($, g, f) => g.has($) || P_("Cannot " + f);
L7: var Ae = ($, g, f) => (Bu($, g, "read from private field"), f ? f.call($) : g.get($)), yt = ($, g, f) => g.has($) ? P_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as qF, ref as vi, shallowRef as HF, watchEffect as GF, computed as sn, h as x_, defineComponent as Gm, createBlock as YF, renderSlot as WF, createCommentVNode as QF,...
...
L129: usage: {
L130: body: "Cannot delete {subject} because it is linked in these items:",
L131: module: {
...
L10827: else {
L10828: if (n.charCodeAt(0) === 36)
L10829: throw new Error("Unknown operation " + n);
...
L11109: if (k && typeof k != "string")
L11110: throw new Error("Ability.can expects
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-yvK__CBL.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-yvK__CBL.js
CriticalPrevious Version Dangerous Deltadist/App-DVHgBTHP.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-H4FWc9ga.js
HighTrigger Reachable Credential Exfiltrationdist/app-yvK__CBL.js
HighSemantic Analysis Limiteddist/App-DVHgBTHP.js#virtual:string-array:round1
MediumNetwork
MediumOversized Source Filedist/app-yvK__CBL.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.8.0-dev.2.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.8.0-dev.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.