Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@lanyundev/blog-static@1.4.15: Suspicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / @lanyundev/blog-static / 1.4.15

@lanyundev/blog-static@1.4.15

博客静态资源

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Browser page load automatically downloads and executes mutable third-party JavaScript without integrity pinning. No npm install-time execution or local credential/file harvesting was confirmed.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer serves and loads the package's browser assets; `ReadyLoad` runs on DOM readiness.

Impact

A compromise or malicious response from the remote script endpoint can execute arbitrary JavaScript in site visitors' origins.

Mechanism

Runtime fetch plus `new Function` execution of remote analytics code.

Rationale

The remote executable loader is a real, automatic client-side supply-chain risk, but source inspection does not establish malicious intent or an npm-install attack. Warn rather than block.

Evidence

package.jsonjs/custom/all.jsjs/custom/ip_check.jsjs/sw.js

Network endpoints2

www.googletagmanager.com/gtag/js?id=G-DPVPH4TB3Napi.lanyundev.com/api/weibo.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

medium

Evidence for warning

`js/custom/all.js` fetches Google Tag Manager text and executes it with `new Function(n)`.
That loader runs automatically from `ReadyLoad` on browser page initialization.
Remote owner API JSON is fetched at `api.lanyundev.com` for page content.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
No package `index.js` exists despite the manifest main field; inspected code is static browser assets.
`process.env` is bundled Vue environment detection, not credential harvesting; no child-process use found.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 29 file(s), 3.08 MB of source, external domains: api.lanyundev.com, busuanzi.lanyundev.com, connect.qq.com, i.ytimg.com, lanyundev.com, maps.google, npms.io, player.vimeo.com, plus.google.com, service.weibo.com, shuo.douban.com, sns.qzone.qq.com, stuk.github.io, twitter.com, vuejs.org, widget.qweather.net, www.facebook.com, www.googletagmanager.com, www.linkedin.com, www.w3.org

Source & flagged code

4 flagged · loading source

js/GitHub目录下载/vue.jsView file

1!function(e,t){(e=e||self).Vue=t()}(this,(function(){"use strict";var e=Object.freeze({});function t(e){return null==e}function n(e){return null!=e}function r(e){return!0===e}funct...

High

Eval

Package source references dynamic code evaluation.

js/GitHub目录下载/vue.jsView on unpkg · L1

js/custom/all.jsView file

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

js/custom/all.jsView on unpkg · L1

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

js/custom/all.jsView on unpkg · L1

css/fonts/element-icons.woffView file

•path = css/fonts/element-icons.woff kind = high_entropy_blob sizeBytes = 28200 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

css/fonts/element-icons.woffView on unpkg

Findings

1 Critical4 High3 Medium4 Low

CriticalRemote Asset Decode Executejs/custom/all.js

HighChild Process

HighEvaljs/GitHub目录下载/vue.js

HighSame File Env Network Executionjs/custom/all.js

HighShips High Entropy Blobcss/fonts/element-icons.woff

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

88%Warn

Verdict confidence

IntentDangerous Capability

TypeRemote Code Execution

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Authorlanyun

Maintainerslanyundev

Version1.4.17

PublishedJul 18, 2026

LicenseUNLICENSED

Dependencies0

Integrityverified

Package size13.2 MB

Files150

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact18.1 MB · 150 files1 signature(s)

Install lifecycleNo install hooks · other: test

Behavioral surface

ChildProcessEnvironmentVarsEvalNetworkHighEntropyStringsMinifiedUrlStringsNoLicense

LPM CLI

Source & flagged code

4 flagged

js/GitHub目录下载/vue.jsView file

Lines 1-1javascript

1!function(e,t){(e=e||self).Vue=t()}(this,(function(){"use strict";var e=Object.freeze({});function t(e){return null==e}function n(e){return null!=e}function r(e){return!0===e}function i(e){return"string"==typeof e||"number"==typeof e||"symbol"==typeof e||"boolean"==typeof e}function o(e){return null!==e&&"object"==typeof e}var a=Object.prototype.toString;function s(e){return a.call(e).slice(8,-1)}function c(e){return"[object Object]"===a.call(e)}function l(e){return"[object RegExp]"===a.call(e)}function u(e){var t=parseFloat(String(e));return t>=0&&Math.floor(t)===t&&isFinite(e)}function f(e){ ...

High

Eval

Package source references dynamic code evaluation.

js/GitHub目录下载/vue.jsView on unpkg · L1

Long lines were clipped for display.

js/custom/all.jsView file

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

js/custom/all.jsView on unpkg · L1

1const keysToKeep=["load","twikoo-access-token","twikoo","bsz-id"],allowedHosts=["lanyundev.com","localhost:4000"],mainLink="https://lanyundev.com";allowedHosts.includes(window.loca...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

js/custom/all.jsView on unpkg · L1

css/fonts/element-icons.woffView file

•path = css/fonts/element-icons.woff kind = high_entropy_blob sizeBytes = 28200 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

css/fonts/element-icons.woffView on unpkg