registry / @lensmcp/vite-plugin / 1.18.11
@lensmcp/vite-plugin@1.18.11
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe network and browser-hook primitives are disclosed, package-aligned observability features activated by an explicit Vite plugin configuration. The bridge defaults to localhost and inspected source contains no install-time execution or concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
A project imports and enables lensmcpVitePlugin() in its Vite configuration, then runs the Vite dev server.
Impact
Captures browser runtime, console, fetch, route, and instrumentation events for the opted-in development session; no unconsented external exfiltration was found.
Mechanism
Local WebSocket event bridge plus Vite/React instrumentation.
AI rationale
The network and browser-hook primitives are disclosed, package-aligned observability features activated by an explicit Vite plugin configuration. The bridge defaults to localhost and inspected source contains no install-time execution or concrete malicious chain.
Evidence
package.jsonindex.jslib/plugin.jslib/event-mappers.jsREADME.md
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no lifecycle scripts or executable bin.
- lib/plugin.js starts its bridge only from Vite's configureServer hook.
- The injected client uses a WebSocket to configurable host, defaulting to 127.0.0.1.
- Source transforms are limited to opted-in JSX/TSX files outside node_modules.
- No shell execution, filesystem harvesting, remote HTTP endpoint, eval, or destructive action found.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
1 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var N=Object.defineProperty;var l=(e,t)=>N(e,"name",{value:t,configurable:!0});var x=Object.defineProperty,d=l((e,t)=>x(e,"name",{value:t,configurable:!0}),"l");import...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1Findings
1 High2 Medium1 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.18.11.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.18.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.