registry / @lensmcp/vite-plugin / 1.18.12
@lensmcp/vite-plugin@1.18.12
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe observed telemetry collection is the documented, consumer-invoked purpose of this Vite observability plugin and is sent through a localhost bridge by default. Source inspection found no lifecycle execution or concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer adds lensmcpVitePlugin() to a Vite configuration and runs Vite.
Impact
Captures application runtime telemetry in the opted-in development environment.
Mechanism
Local WebSocket browser telemetry bridge and source instrumentation.
AI rationale
The observed telemetry collection is the documented, consumer-invoked purpose of this Vite observability plugin and is sent through a localhost bridge by default. Source inspection found no lifecycle execution or concrete malicious chain.
Evidence
package.jsonindex.jslib/plugin.jslib/event-mappers.jslib/types.jsREADME.md
Network endpoints1
ws://127.0.0.1:<configured-or-ephemeral-port>
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime injects instrumentation that forwards browser telemetry over a WebSocket.
- The plugin wraps console, fetch, route, and error handlers when explicitly enabled in Vite.
Evidence against
- package.json has no preinstall, install, or postinstall scripts.
- The bridge server defaults to 127.0.0.1 and uses an ephemeral/configured local port.
- No child-process, filesystem-write, credential harvesting, remote URL, eval, or binary-loading code was found in package files.
- Activation requires a consumer to add the Vite plugin; import only exports its API.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
2 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var N=Object.defineProperty;var l=(e,t)=>N(e,"name",{value:t,configurable:!0});var x=Object.defineProperty,d=l((e,t)=>x(e,"name",{value:t,configurable:!0}),"l");import...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L189function open() {
try { ws = new WebSocket(WS_URL); } catch (e) { setTimeout(open, 1000); return; }
ws.addEventListener('open', () => {
openOnce = true;
while (queue.length) {
const chunk = queue.splice(0, 200);
try { ws.send(JSON.stringify(chunk.length === 1 ? chunk[0] : { kind: 'batch', at: Date.now(), tabId: TAB_ID, events: chunk })); } catch (e) {}
}
send({ kind: 'ready', userAgent: navigator.userAgent, url: location.href });
});
ws.addEventListener('close', () => { if (openOnce) setTimeout(open, 1000); });
ws.addEventListener('
Low
Ai Review Evidence
Runtime injects instrumentation that forwards browser telemetry over a WebSocket.
lib/plugin.jsView on unpkg · L89Findings
1 High2 Medium2 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review Evidencelib/plugin.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.18.12.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.18.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.