@lensmcp/vite-plugin@1.19.0
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe observed monitoring behavior is the package's stated Vite-plugin function and uses a localhost default after explicit project configuration. Inspection found no install-time execution or concrete exfiltration, persistence, payload staging, or destructive chain.
Decision evidence
public snapshot- Injects a browser runtime that opens a WebSocket observability bridge.
- Runtime captures console, fetch, errors, and route events.
- package.json has no lifecycle scripts.
- The bridge defaults to localhost and is activated through Vite plugin configuration.
- No shell execution, filesystem harvesting, credential access, remote payload loading, or destructive action was found.
Source & flagged code
3 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1Injects a browser runtime that opens a WebSocket observability bridge.
lib/plugin.jsView on unpkg · L1Runtime captures console, fetch, errors, and route events.
lib/plugin.jsView on unpkg · L90Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.19.0.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.