@lensmcp/vite-plugin@1.25.0
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe inspected behavior matches the package’s stated Vite browser event bridge, with a loopback default endpoint and no install hook or confirmed unrelated credential transfer. The static environment-variable and dependency-bridge hints do not establish malicious behavior.
Decision evidence
public snapshot- The manifest points to index.js and describes a Vite plugin that provides a browser event bridge.
- The plugin defaults to enabled with a loopback WebSocket host and starts its bridge when Vite configures a server.
- The injected client sends batched browser events over the bridge WebSocket; the source shows no unrelated credential transfer or publisher-selected endpoint.
- The client captures browser errors, including resource URLs, and forwards them through the WebSocket. This is consistent with the package’s stated browser event bridge functionality.
Source & flagged code
8 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1The plugin defaults to enabled with a loopback WebSocket host and starts its bridge when Vite configures a server.
lib/plugin.jsView on unpkg · L1The plugin defaults to enabled with a loopback WebSocket host and starts its bridge when Vite configures a server.
Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.0.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.