registry / @feedmepos/mf-inventory-portal / 1.8.7
@feedmepos/mf-inventory-portal@1.8.7
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe inspected token transfer is a 401-triggered refresh to the same FeedMe account host configured by the prepared auth dependency. The package also depends on @feedmepos/core, whose implementation was unavailable in the inspected snapshot, so the full selected dependency behavior cannot be resolved.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A FeedMe API request receives an HTTP 401 response.
Impact
The inspected flow performs ordinary token refresh; behavior in the unavailable dependency remains unresolved.
Mechanism
The app sends the current session token to account.feedmedev.cc for refresh, then retries the request.
AI rationale
The inspected token transfer is a 401-triggered refresh to the same FeedMe account host configured by the prepared auth dependency. The package also depends on @feedmepos/core, whose implementation was unavailable in the inspected snapshot, so the full selected dependency behavior cannot be resolved.
Evidence
package.json.lpm-dependency-evidence-cb005bda-1ae1-4b8d-a8c9-6eceb5d735b8/0/npm-linux/package.json
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package exports its built application from dist/app.js and declares @feedmepos/core as a dependency.
- The prepared @feedmepos/mf-common dependency also declares @feedmepos/core, whose implementation was unavailable in the inspected snapshot.
- On an HTTP 401, the app passes the current session token to its refresh helper and retries the request.
- The refresh helper posts the token to account.feedmedev.cc, the same base URL configured by the prepared FeedMe auth client.
Evidence against
- The inspected authentication flow is a token refresh to the FeedMe account host; it does not establish an unrelated credential recipient.
- The reviewed package manifest shows build and development scripts, with no install hook in the inspected script list.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-BYlSMlhd.jsView file
30140var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, ot = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(le) * ot / Oe.internal.scaleFactor;
L30141: return new function(yt) {
L30142: var Nt = (yt = yt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-BYlSMlhd.jsView on unpkg · L30140dist/app-DBVcUO6a.jsView file
6var Bu = ($, g, f) => HI($, typeof g != "symbol" ? g + "" : g, f), Ru = ($, g, f) => g.has($) || N_("Cannot " + f);
L7: var Ae = ($, g, f) => (Ru($, g, "read from private field"), f ? f.call($) : g.get($)), ht = ($, g, f) => g.has($) ? N_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as GI, ref as Fi, shallowRef as YI, watchEffect as WI, computed as gn, h as J_, defineComponent as Wm, createBlock as QI, renderSlot as KI, createCommentVNode as ZI,...
...
L129: usage: {
L130: body: "{subject} is still used by the following items:",
L131: module: {
...
L10894: else {
L10895: if (n.charCodeAt(0) === 36)
L10896: throw new Error("Unknown operation " + n);
...
L11176: if (O && typeof O != "string")
L11177: throw new Error("Ability.can expects 3rd paramete
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-DBVcUO6a.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-DBVcUO6a.js
CriticalPrevious Version Dangerous Deltadist/feature-BSnK0SxL.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-BYlSMlhd.js
HighTrigger Reachable Credential Exfiltrationdist/app-DBVcUO6a.js
HighSemantic Analysis Limiteddist/App-CaXTVLQX.js#virtual:string-array:round1
MediumNetwork
MediumOversized Source Filedist/app-DBVcUO6a.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.8.7.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.8.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.