@lensmcp/vite-plugin@1.23.1
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe flagged runtime bridge is consistent with the package's Vite instrumentation purpose, and its client connects to the configured bridge host, defaulting to loopback. The manifest has no lifecycle scripts, and the inspected source establishes no malicious attack behavior.
Decision evidence
public snapshot- The manifest declares the package entrypoints and lists matching LensMCP instrumentation dependencies.
- The repository metadata identifies this as the LensMCP Vite plugin.
- The plugin defaults its WebSocket host to loopback and activates as a Vite plugin.
- The injected browser client connects to the host and port supplied to the plugin.
Source & flagged code
6 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1The plugin defaults its WebSocket host to loopback and activates as a Vite plugin.
lib/plugin.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.23.1.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.23.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.