registry / @lensmcp/vite-plugin / 1.18.14
@lensmcp/vite-plugin@1.18.14
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an explicit, package-aligned Vite observability plugin with a localhost default, not an install-time or covert exfiltration chain. Its broad browser telemetry is a user-invoked development capability and does not establish malicious intent.
Static reason
One or more suspicious static signals were detected.
Trigger
A developer adds and runs lensmcpVitePlugin() in a Vite development server.
Impact
Intentional development telemetry can include console data, errors, URLs, and fetch metadata in the local LensMCP bridge.
Mechanism
Vite source instrumentation and browser event forwarding over WebSocket.
AI rationale
This is an explicit, package-aligned Vite observability plugin with a localhost default, not an install-time or covert exfiltration chain. Its broad browser telemetry is a user-invoked development capability and does not establish malicious intent.
Evidence
package.jsonindex.jslib/plugin.jslib/event-mappers.jsREADME.md
Network endpoints1
ws://127.0.0.1:<configured-or-ephemeral-port>
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No lifecycle scripts are declared.
- Runtime is created only through the exported Vite plugin and defaults to localhost.
- No child-process, filesystem-write, eval, credential-harvesting, or remote-payload code was found.
Evidence against
- When explicitly enabled in a Vite config, injected browser code captures console values, errors, routes, and fetch URLs.
- Captured observability events are sent over a WebSocket; the host is configurable.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
4 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var N=Object.defineProperty;var c=(e,t)=>N(e,"name",{value:t,configurable:!0});var P=Object.defineProperty,p=c((e,t)=>P(e,"name",{value:t,configurable:!0}),"l"),x=Obje...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11const o=e.enabled??!0,f=e.wsHost??"127.0.0.1",s=e.injectClient??!0;
Low
Ai Review Evidence
Runtime is created only through the exported Vite plugin and defaults to localhost.
lib/plugin.jsView on unpkg · L1package.jsonView file
8"exports": {
"./package.json": "./package.json",
".": {
"types": "./index.d.ts",
"import": "./index.js",
"default": "./index.js"
}
}
Findings
1 High2 Medium4 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.18.14.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.18.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.