registry / @lensmcp/vite-plugin / 1.21.1
@lensmcp/vite-plugin@1.21.1
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection shows an explicitly integrated development observability plugin, not install-time or covert malware. Its telemetry hooks are package-aligned, user-invoked, and default to a loopback bridge with no fixed external receiver.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer adds lensmcpVitePlugin() to a Vite configuration and starts Vite.
Impact
Observability data can include console arguments, error details, URLs, and route metadata; destination defaults to loopback and no unconsented exfiltration endpoint is embedded.
Mechanism
Injected browser telemetry forwarded to a configurable LensMCP bridge.
AI rationale
Source inspection shows an explicitly integrated development observability plugin, not install-time or covert malware. Its telemetry hooks are package-aligned, user-invoked, and default to a loopback bridge with no fixed external receiver.
Evidence
package.jsonindex.jslib/plugin.jslib/event-mappers.jslib/plugin.d.tsREADME.md
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Explicitly configured Vite plugin injects a browser observability runtime.
- Runtime captures console, error, fetch, and route metadata over a WebSocket.
- WebSocket host defaults to loopback but is configurable by the plugin user.
Evidence against
- package.json has no lifecycle scripts.
- No child-process, shell, eval, filesystem-write, or credential-harvesting code found.
- No fixed external endpoint or remote payload loader is present.
- The runtime is activated only when the consumer adds and enables the Vite plugin.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
4 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var N=Object.defineProperty;var d=(e,t)=>N(e,"name",{value:t,configurable:!0});var x=Object.defineProperty,u=d((e,t)=>x(e,"name",{value:t,configurable:!0}),"c");import...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11transformIndexHtml(){if(!(!i||!s))return[{tag:"script",attrs:{type:"module",src:I},injectTo:"head-prepend"}]}
Low
Ai Review Evidence
Explicitly configured Vite plugin injects a browser observability runtime.
lib/plugin.jsView on unpkg · L189function open() {
try { ws = new WebSocket(WS_URL); } catch (e) { setTimeout(open, 1000); return; }
ws.addEventListener('open', () => {
openOnce = true;
while (queue.length) {
const chunk = queue.splice(0, 200);
try { ws.send(JSON.stringify(chunk.length === 1 ? chunk[0] : { kind: 'batch', at: Date.now(), tabId: TAB_ID, events: chunk })); } catch (e) {}
}
send({ kind: 'ready', userAgent: navigator.userAgent, url: location.href });
});
ws.addEventListener('close', () => { if (openOnce) setTimeout(open, 1000); });
ws.addEventListener('
Findings
1 High2 Medium4 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.21.1.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.21.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.