Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@lanyundev/blog-static: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / @lanyundev/blog-static / 1.4.16

@lanyundev/blog-static@1.4.16

博客静态资源

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Browser runtime code fetches a remote Google Tag Manager response and evaluates it as JavaScript. Separate runtime code injects a remote IP-information script and fetches site content/API data.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading `js/custom/all.js` or `js/custom/ip_check.js` in a browser page.

Impact

A compromised or changed remote endpoint can execute arbitrary code in visitors' page origin.

Mechanism

Remote script retrieval followed by dynamic JavaScript execution.

Rationale

The package contains a concrete browser-side remote code execution mechanism, but the endpoint is a declared Google Analytics resource and source inspection found no install hook, local harvesting, or destructive behavior. Warn rather than block.

Evidence

package.jsonjs/custom/all.jsjs/custom/ip_check.jsjs/sw.js

Network endpoints4

www.googletagmanager.com/gtag/js?id=G-DPVPH4TB3Nlanyundev.com/api/ip_infoapi.lanyundev.com/api/weibo.jsonapi.lanyundev.com/api/pixiv.json

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

`js/custom/all.js` fetches Google Tag Manager code and executes it with `new Function(n)`.
This remote-code path runs during browser script load, without user interaction.
The same bundle fetches package-site APIs and inserts fetched `/notice` HTML into the DOM.
`js/custom/ip_check.js` injects and executes a remote script from `lanyundev.com/api/ip_info`.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
No package JavaScript references `child_process` or Node credential/file APIs.
No evidence of npm-install-time mutation, persistence, or local credential harvesting.
Other `Function` hits are bundled framework/polyfill code; no `eval(` or `atob(` occurs in `js/custom/all.js`.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 29 file(s), 3.08 MB of source, external domains: api.lanyundev.com, busuanzi.lanyundev.com, connect.qq.com, i.ytimg.com, lanyundev.com, maps.google, npms.io, player.vimeo.com, plus.google.com, service.weibo.com, shuo.douban.com, sns.qzone.qq.com, stuk.github.io, twitter.com, vuejs.org, widget.qweather.net, www.facebook.com, www.googletagmanager.com, www.linkedin.com, www.w3.org

Source & flagged code

4 flagged · loading source

js/GitHub目录下载/vue.jsView file

1!function(e,t){(e=e||self).Vue=t()}(this,(function(){"use strict";var e=Object.freeze({});function t(e){return null==e}function n(e){return null!=e}function r(e){return!0===e}funct...

High

Eval

Package source references dynamic code evaluation.

js/GitHub目录下载/vue.jsView on unpkg · L1

js/custom/all.jsView file

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

js/custom/all.jsView on unpkg · L1

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

js/custom/all.jsView on unpkg · L1

css/fonts/element-icons.woffView file

•path = css/fonts/element-icons.woff kind = high_entropy_blob sizeBytes = 28200 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

css/fonts/element-icons.woffView on unpkg

Findings

1 Critical4 High3 Medium4 Low

CriticalRemote Asset Decode Executejs/custom/all.js

HighChild Process

HighEvaljs/GitHub目录下载/vue.js

HighSame File Env Network Executionjs/custom/all.js

HighShips High Entropy Blobcss/fonts/element-icons.woff

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

90%Warn

Verdict confidence

IntentCritical Vulnerability

TypeRemote Code Execution

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Authorlanyun

Maintainerslanyundev

Version1.4.17

PublishedJul 18, 2026

LicenseUNLICENSED

Dependencies0

Integrityverified

Package size13.2 MB

Files149

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact18.0 MB · 149 files1 signature(s)

Install lifecycleNo install hooks · other: test

Behavioral surface

ChildProcessEnvironmentVarsEvalNetworkHighEntropyStringsMinifiedUrlStringsNoLicense

LPM CLI

Source & flagged code

4 flagged

js/GitHub目录下载/vue.jsView file

Lines 1-1javascript

1!function(e,t){(e=e||self).Vue=t()}(this,(function(){"use strict";var e=Object.freeze({});function t(e){return null==e}function n(e){return null!=e}function r(e){return!0===e}function i(e){return"string"==typeof e||"number"==typeof e||"symbol"==typeof e||"boolean"==typeof e}function o(e){return null!==e&&"object"==typeof e}var a=Object.prototype.toString;function s(e){return a.call(e).slice(8,-1)}function c(e){return"[object Object]"===a.call(e)}function l(e){return"[object RegExp]"===a.call(e)}function u(e){var t=parseFloat(String(e));return t>=0&&Math.floor(t)===t&&isFinite(e)}function f(e){ ...

High

Eval

Package source references dynamic code evaluation.

js/GitHub目录下载/vue.jsView on unpkg · L1

Long lines were clipped for display.

js/custom/all.jsView file

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

js/custom/all.jsView on unpkg · L1

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

js/custom/all.jsView on unpkg · L1

css/fonts/element-icons.woffView file

•path = css/fonts/element-icons.woff kind = high_entropy_blob sizeBytes = 28200 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

css/fonts/element-icons.woffView on unpkg