@feedmepos/mf-inventory-portal@1.8.6
## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe exported runtime can forward a saved session token to a fixed development-domain endpoint during 401 recovery. The source does not show that the endpoint is unrelated to the vendor, so this warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A protected API request receives HTTP 401 and retry attempts remain.
Impact
The session token reaches a fixed development-domain endpoint; source does not establish whether that endpoint is an intended vendor identity service.
Mechanism
The refresh flow posts the session token to account.feedmedev.cc and exchanges the response for an ID token.
AI rationale
The exported runtime can forward a saved session token to a fixed development-domain endpoint during 401 recovery. The source does not show that the endpoint is unrelated to the vendor, so this warrants a warning rather than a publish block.
Evidence
package.jsondist/app.jsdist/app-9xhFF2Tw.js
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports dist/app.js, which imports the bundle containing the token-refresh logic.
- The bundle sends the saved session token to a fixed development-domain account endpoint in a token exchange.
- A protected API request carries the session token as a bearer token and passes it to refreshAuth after a 401 response.
- The refresh flow requests an ID token; the source does not establish whether the fixed development-domain endpoint is outside the vendor’s control.
Evidence against
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-CqNAo2_T.jsView file
30140var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, ot = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(le) * ot / Oe.internal.scaleFactor;
L30141: return new function(yt) {
L30142: var Nt = (yt = yt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-CqNAo2_T.jsView on unpkg · L30140dist/app-9xhFF2Tw.jsView file
6var Bu = ($, g, f) => HI($, typeof g != "symbol" ? g + "" : g, f), Ru = ($, g, f) => g.has($) || N_("Cannot " + f);
L7: var Ae = ($, g, f) => (Ru($, g, "read from private field"), f ? f.call($) : g.get($)), ht = ($, g, f) => g.has($) ? N_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as GI, ref as Fi, shallowRef as YI, watchEffect as WI, computed as gn, h as J_, defineComponent as Wm, createBlock as QI, renderSlot as KI, createCommentVNode as ZI,...
...
L129: usage: {
L130: body: "{subject} is still used by the following items:",
L131: module: {
...
L10894: else {
L10895: if (n.charCodeAt(0) === 36)
L10896: throw new Error("Unknown operation " + n);
...
L11176: if (O && typeof O != "string")
L11177: throw new Error("Ability.can expects 3rd paramete
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-9xhFF2Tw.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-9xhFF2Tw.js
CriticalPrevious Version Dangerous Deltadist/feature-CyMu-oDj.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-CqNAo2_T.js
HighTrigger Reachable Credential Exfiltrationdist/app-9xhFF2Tw.js
HighSemantic Analysis Limiteddist/App-ufvAG4du.js#virtual:string-array:round1
MediumNetwork
MediumOversized Source Filedist/app-9xhFF2Tw.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.8.6.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.8.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.