registry / @feedmepos/mf-inventory-portal / 1.9.0-dev.5
@feedmepos/mf-inventory-portal@1.9.0-dev.5
⚠ Under review## Description
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged token transfer is part of a refresh flow directed to the FeedMe account host, and the package has no install lifecycle script. I could not resolve the source behavior of declared @feedmepos/core, so the available evidence does not support either a clean verdict or a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation or runtime use may activate declared dependencies; the inspected bundle also refreshes authentication after a service response requires it.
Impact
No credential theft or other attack is established by the inspected source; unresolved dependency behavior prevents a clean verdict.
Mechanism
The bundle posts a token to the FeedMe account host for token refresh. The declared @feedmepos/core dependency could not be cleared by source inspection.
AI rationale
The flagged token transfer is part of a refresh flow directed to the FeedMe account host, and the package has no install lifecycle script. I could not resolve the source behavior of declared @feedmepos/core, so the available evidence does not support either a clean verdict or a confirmed attack.
Evidence
package.jsondist/app.jsdist/app-DMflhu6b.js
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares @feedmepos/core as a dependency, whose source behavior could not be resolved in this review.
- The package entrypoint exports from dist/app-DMflhu6b.js, and that bundle sends a token to the hardcoded account.feedmedev.cc host during token refresh.
Evidence against
- The package manifest points to dist/app.js and lists no install lifecycle script.
- The inspected refresh code uses the FeedMe account host; the source does not establish that this is an unrelated credential recipient.
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-BDZaoowM.jsView file
30260var Oe = this.pdf, ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(le) * it / Oe.internal.scaleFactor;
L30261: return new function(wt) {
L30262: var Nt = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-BDZaoowM.jsView on unpkg · L30260dist/app-DMflhu6b.jsView file
6var Du = ($, g, f) => YI($, typeof g != "symbol" ? g + "" : g, f), Vu = ($, g, f) => g.has($) || j_("Cannot " + f);
L7: var Ae = ($, g, f) => (Vu($, g, "read from private field"), f ? f.call($) : g.get($)), ht = ($, g, f) => g.has($) ? j_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as WI, ref as Fi, shallowRef as QI, watchEffect as KI, computed as gn, h as U_, defineComponent as Km, createBlock as ZI, renderSlot as XI, createCommentVNode as eF,...
...
L129: usage: {
L130: body: "{subject} is still used by the following items:",
L131: module: {
...
L10894: else {
L10895: if (n.charCodeAt(0) === 36)
L10896: throw new Error("Unknown operation " + n);
...
L11176: if (O && typeof O != "string")
L11177: throw new Error("Ability.can expects 3rd paramete
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-DMflhu6b.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-DMflhu6b.js
CriticalPrevious Version Dangerous Deltadist/feature-h3MFKUcz.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-BDZaoowM.js
HighTrigger Reachable Credential Exfiltrationdist/app-DMflhu6b.js
HighSemantic Analysis Limiteddist/App-DDALXIcF.js#virtual:string-array:round1
MediumNetwork
MediumOversized Source Filedist/app-DMflhu6b.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.9.0-dev.5.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.9.0-dev.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.