registry / @kedataindo/docflow-vue / 0.0.5

@kedataindo/docflow-vue@0.0.5

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Vue document-editor UI with an optional user-triggered same-origin AI helper request.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes an AI sidebar action after rendering the component.

Impact

Document text is sent to the host application's configured same-origin AI backend only when the user uses that feature.

Mechanism

POST document content to a same-origin AI helper endpoint.

Rationale

Static inspection finds no install-time execution, credential harvesting, exfiltration to an attacker-controlled host, persistence, or destructive behavior. The scanner's network and secret signals resolve to an explicit UI AI feature, local editor storage, and ordinary registry/font URLs.

Evidence

package.jsondist/index.jsdist/index.cjsdist/style.cssdist/index.d.tsdist/components/sidebars/AISidebar.vue.d.tsdist/components/DocsEditor.vue.d.ts

Network endpoints1

/api/ai/copilot

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, postinstall, or bin hook.
dist/index.js imports Vue/editor dependencies only; no shell, filesystem, eval, or native loading found.
The sole fetch is in the AISidebar and posts to same-origin /api/ai/copilot.
The AI request is activated by sidebar actions and sends the displayed document content, not harvested credentials.
localStorage writes store editor theme and current document state locally.
No executable artifacts, hidden scripts, or remote payload URLs were present.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 366 KB of source, external domains: www.w3.org

Source & flagged code

5 flagged

dist/index.jsView file

Lines 368-408javascript

368 activeFilters: "Active Filters:",

369 folder: "Folder",

370 starredOnly: "Starred Only",

371 search: "Search",

372 noDocuments: "No documents found",

373 noDocumentsDescription: "No files match your current filters. Select a template or create a blank file to start drafting!",

374 createBlankDocument: "Create Blank Document",

375 loadingDocuments: "Loading documents...",

376 documentTitle: "Document Title",

377 lastModified: "Last Modified",

378 actions: "Actions"

379 },

380 auth: {

381 signInTitle: "Sign in to create and edit documents",

382 signInWithGoogle: "Sign in with Google",

383 signInWithEmail: "Sign in with Email",

384 signInWithGitHub: "Sign in with GitHub",

385 signInWith: "Sign in with {provider}",

386 or: "or",

387 email: "Email",

388 password: "Password",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L388

389 name: "Name",

390 signIn: "Sign In",

391 signUp: "Sign Up",

392 signOut: "Sign out",

393 noAccount: "Don't have an account? Sign up",

394 hasAccount: "Already have an account? Sign in",

395 invalidCredentials: "Invalid email or password",

396 accountCreated: "Account created! You are now signed in.",

397 loadDocumentsError: "Failed to load documents. Is the server running?",

398 retry: "Try again",

399 rateLimited: "Server is rate limiting requests.",

400 retryIn: "Retrying in {seconds}s…",

401 networkError: "Could not reach the server. Check your connection.",

402 noProviders: "No authentication providers configured. Check your server environment variables."

403 },

404 language: {

405 label: "Language",

406 en: "English",

407 id: "Indonesian"

408 }

Lines 700-740javascript

700 activeFilters: "Filter Aktif:",

701 folder: "Folder",

702 starredOnly: "Hanya Berbintang",

703 search: "Cari",

704 noDocuments: "Tidak ada dokumen",

705

dist/locales/en.d.tsView file

Lines 292-332typescript

292 readonly activeFilters: "Active Filters:";

293 readonly folder: "Folder";

294 readonly starredOnly: "Starred Only";

295 readonly search: "Search";

296 readonly noDocuments

dist/locales/id.d.tsView file

Lines 292-332typescript

292 readonly activeFilters: "Filter Aktif:";

293 readonly folder: "Folder";

294 readonly starredOnly: "Hanya Berbintang";

295 readonly search: "Cari";

296 readonly noDocuments

dist/index.cjsView file

Lines 1-21javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const Lt=require("@kedataindo/docflow-core"),e=require("vue"),De=require("@kedataindo/docflow-layout-engine");

Source & flagged code

5 flagged · loading source

dist/index.jsView file

720patternName = generic_password severity = medium line = 720 matchedText = password...di",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L720

388patternName = generic_password severity = medium line = 388 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L388

dist/locales/en.d.tsView file

312patternName = generic_password severity = medium line = 312 matchedText = readonly...rd";

Medium

Secret Pattern

Hardcoded password in dist/locales/en.d.ts

dist/locales/en.d.tsView on unpkg · L312

Findings

6 Medium4 Low

MediumSecret Patterndist/index.js

MediumNetwork

MediumSecret Patterndist/locales/en.d.ts

MediumSecret Patterndist/locales/id.d.ts

MediumSecret Patterndist/index.js

MediumSecret Patterndist/index.cjs

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License