@lensmcp/vite-plugin@1.25.14
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source ties the plugin and its bridge to the same LensMCP project, and the flagged dependency bridge is used for the package’s stated event-forwarding function. The observed local, token-protected development reporting is package-aligned behavior, so the scanner signals do not establish malicious activity.
Decision evidence
public snapshot- The manifest points to index.js and identifies this package as the LensMCP Vite plugin in the matching repository.
- The package entrypoint exports the Vite plugin and its event conversion helper.
- When the enabled plugin configures Vite, it starts a tokenized bridge on the loopback host by default. Browser events are sent over its WebSocket connection, and the bridge checks origins and tokens and limits connections.
- The flagged bridge dependency exports event mapping and server functions; its mapper converts console events into client runtime events. The inspected core and Babel entrypoints are library modules.
Source & flagged code
9 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1When the enabled plugin configures Vite, it starts a tokenized bridge on the loopback host by default. Browser events are sent over its WebSocket connection, and the bridge checks origins and tokens and limits connections.
lib/plugin.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.14.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.