registry / @lensmcp/vite-plugin / 1.25.16
@lensmcp/vite-plugin@1.25.16
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection shows an ordinary Vite observability plugin with a loopback event bridge and aligned LensMCP dependencies. The scanner’s bridge signal reflects an explicit runtime dependency, and no concrete attack surface was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Vite starts in serve mode; build mode requires an explicit configuration or environment opt-in.
Impact
The inspected behavior supports local development observability; no unrelated recipient or harmful action was established.
Mechanism
The plugin starts a loopback WebSocket bridge and publishes mapped browser events through the LensMCP bus or sink.
AI rationale
Source inspection shows an ordinary Vite observability plugin with a loopback event bridge and aligned LensMCP dependencies. The scanner’s bridge signal reflects an explicit runtime dependency, and no concrete attack surface was found.
Evidence
package.jsonindex.jslib/plugin.js.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/0/npm-linux/package.json.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/0/npm-linux/index.js.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/0/npm-linux/lib/event-mappers.js.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/1/npm-linux/package.json.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/1/npm-linux/index.js.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/2/npm-linux/package.json.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/2/npm-linux/lib/index.js
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports the Vite plugin entrypoint and declares the bridge and core as same-version dependencies.
- The plugin starts its bridge when Vite serves; build use requires an explicit environment opt-in or configuration.
- The bridge exports a server and publisher, and its event mapper converts browser console events into client-runtime events.
- The inspected bridge and core manifests identify same-version LensMCP packages; the Babel entrypoint exposes compiler APIs.
- No attack behavior was identified in the inspected entrypoints or required dependency paths.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
9 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var $=Object.defineProperty;var g=(e,t)=>$(e,"name",{value:t,configurable:!0});var G=Object.defineProperty,u=g((e,t)=>G(e,"name",{value:t,configurable:!0}),"d");import...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11transformSource??!0,v=e.applyOnBuild??process.env.LENSMCP_VITE_APPLY_ON_BUILD==="1";return{name:"@lensmcp/vite-plugin",apply:u((n,a)=>r&&(a.command==="serve"||v),"apply"),enforce:"pre",wsPort:u(()=>p,"wsPort"),config(n){
Low
Ai Review Evidence
The plugin starts its bridge when Vite serves; build use requires an explicit environment opt-in or configuration.
lib/plugin.jsView on unpkg · L1package.jsonView file
5"./index.js",
"module": "./index.js",
"types": "./index.d.ts",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./index.d.ts",
"import": "./index.j
Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencelib/plugin.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/0/npm-linux/index.js
LowAi Review Evidence.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/1/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-8435fe7c-58c3-417d-80b1-4f67837129b2/1/npm-linux/index.js
LowAi Review Evidence
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.16.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.