@lensmcp/vite-plugin@1.21.4
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection shows development-time observability instrumentation, not install-time execution, persistence, or exfiltration. The scanner signals are explained by the local bridge, optional watcher configuration, and browser event capture.
Decision evidence
public snapshot- The plugin injects a browser runtime that opens a WebSocket bridge and observes browser events.
- The manifest has import-only entry points and no lifecycle scripts.
- No command execution, file writes, credential harvesting, or external network endpoint appears in the inspected source.
- The WebSocket runtime is activated only through Vite plugin configuration.
- The browser instrumentation sends observability events to the configured local bridge rather than an embedded remote host.
- The environment variable only supplies optional watch roots.
Source & flagged code
4 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1The plugin injects a browser runtime that opens a WebSocket bridge and observes browser events.
lib/plugin.jsView on unpkg · L45Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.21.4.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.21.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.