registry / @lensmcp/vite-plugin / 1.21.5
@lensmcp/vite-plugin@1.21.5
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe observed collection behavior is an explicit Vite-plugin capability and defaults to a loopback bridge. No install-time execution, external exfiltration endpoint, persistence, destructive action, or hidden payload was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer explicitly adds lensmcpVitePlugin to a Vite configuration and starts the development server.
Impact
Console values, URLs, errors, and fetch metadata can be exposed to the configured local LensMCP bridge during development.
Mechanism
Injected browser observability runtime over a configurable local WebSocket.
AI rationale
The observed collection behavior is an explicit Vite-plugin capability and defaults to a loopback bridge. No install-time execution, external exfiltration endpoint, persistence, destructive action, or hidden payload was found.
Network endpoints1
ws://127.0.0.1:<ephemeral-port>
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The Vite plugin injects a browser runtime that captures console output and fetch metadata.
- The runtime opens a WebSocket using the configured host and port; the default host is loopback.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle script.
- The package runs only when a consumer adds and enables the Vite plugin; no external endpoint, shell execution, file write, or credential harvesting is present in inspected source.
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
7 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var W=Object.defineProperty;var f=(e,t)=>W(e,"name",{value:t,configurable:!0});var $=Object.defineProperty,d=f((e,t)=>$(e,"name",{value:t,configurable:!0}),"u");import...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1209// Console
for (const level of ['log','info','warn','error','debug']) {
const original = console[level];
console[level] = function(...args) {
try { send({ kind: 'console', level, args: args.map((a) => safe(a)) }); } catch {}
return original.apply(this, args);
};
Low
Ai Review Evidence
The Vite plugin injects a browser runtime that captures console output and fetch metadata.
lib/plugin.jsView on unpkg · L209218// fetch
const origFetch = window.fetch.bind(window);
window.fetch = async function(input, init) {
const method = (init && init.method) || (input && input.method) || 'GET';
const url = typeof input === 'string' ? input : (input && (input.url || String(input)));
const start = Date.now();
Findings
2 High3 Medium6 Low
HighCopied Package Dependency Bridgelib/plugin.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.21.5.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.21.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.