registry / @lensmcp/vite-plugin / 1.25.10
@lensmcp/vite-plugin@1.25.10
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe manifest and entrypoints identify a Vite development plugin that uses same-family LensMCP bridge and event packages. Source review found no install-time behavior or concrete attack behavior in the required paths.
Static reason
One or more suspicious static signals were detected.
Trigger
A Vite development server uses the enabled plugin.
Impact
The reviewed flow supports local development observability; no unrelated recipient or malicious action was established.
Mechanism
The plugin injects a browser runtime that sends events over a WebSocket to the bridge, which maps them into LensMCP events.
AI rationale
The manifest and entrypoints identify a Vite development plugin that uses same-family LensMCP bridge and event packages. Source review found no install-time behavior or concrete attack behavior in the required paths.
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to index.js and declares LensMCP bridge, core, and protocol packages; the inspected manifest has no lifecycle hook.
- The package entrypoint exports the Vite plugin and bridge helpers. The plugin sends browser events over its WebSocket, and the bridge maps them into LensMCP events.
- The bridge dependency is a same-family LensMCP package. The inspected core and protocol files expose event, redaction, storage, and bounded-writer modules; no attack behavior was identified in the reviewed paths.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
9 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var $=Object.defineProperty;var g=(e,t)=>$(e,"name",{value:t,configurable:!0});var G=Object.defineProperty,u=g((e,t)=>G(e,"name",{value:t,configurable:!0}),"d");import...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1package.jsonView file
1{
"name": "@lensmcp/vite-plugin",
"version": "1.25.10",
"type": "module",
"main": "./index.js",
"module": "./index.js",
"types": "./index.d.ts",
"exports": {
"./p
Low
Suspicious Lifecycle Evidence
package.json points to index.js and declares LensMCP bridge, core, and protocol packages; the inspected manifest has no lifecycle hook.
package.jsonView on unpkg · L19ackage.json": "./package.json",
".": {
"types": "./index.d.ts",
"import": "./index.js",
"default": "./index.js"
}
},
"dependencies": {
"@babel/core": "^7.0.0",
"@lensmcp/bridge": "1.25.10",
"@lensmcp/core": "1.25.10",
"@lensmcp/protocol-types": "1.25.10",
"@lensmcp/react-instrumentation": "1.25.10",
"@lensmcp/valtio-instrumentation": "1.25.10",
Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-66671845-881a-4527-a2d9-8f1ff031494e/0/npm-linux/lib/event-mappers.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-66671845-881a-4527-a2d9-8f1ff031494e/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-66671845-881a-4527-a2d9-8f1ff031494e/0/npm-linux/index.js
LowAi Review Evidence.lpm-dependency-evidence-66671845-881a-4527-a2d9-8f1ff031494e/0/npm-linux/index.d.ts
Low
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.10.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.