@lensmcp/vite-plugin@1.21.3
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection shows a Vite development-observability plugin with loopback-default WebSocket telemetry and no install-time execution or malicious behavior. The scanner's network signal reflects this declared runtime bridge rather than a concrete attack.
Decision evidence
public snapshot- The manifest declares module entrypoints and LensMCP dependencies, with no install lifecycle script.
- The Vite plugin injects a browser runtime that records development telemetry, including console and fetch metadata.
- That runtime opens its bridge WebSocket to the configured host, which defaults to loopback.
- No lifecycle hook, shell execution, file write, credential harvesting, or external endpoint is present in the inspected source.
- The observed instrumentation is activated through the exported Vite plugin and is consistent with its development-observability role.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1The Vite plugin injects a browser runtime that records development telemetry, including console and fetch metadata.
lib/plugin.jsView on unpkg · L181That runtime opens its bridge WebSocket to the configured host, which defaults to loopback.
Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.21.3.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.21.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.