registry / @lensmcp/vite-plugin / 1.25.18
@lensmcp/vite-plugin@1.25.18
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected runtime behavior is consistent with a Vite observability plugin using same-version LensMCP components and a local bridge. Static hints alone do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A Vite development server loads the enabled plugin.
Impact
No malicious impact was established from the inspected source.
Mechanism
The plugin serves its client runtime and forwards browser events through a loopback bridge; session replay is a bundled product feature.
AI rationale
The manifest has no install lifecycle hook, and the inspected runtime behavior is consistent with a Vite observability plugin using same-version LensMCP components and a local bridge. Static hints alone do not establish malicious behavior.
Evidence
package.jsonlib/plugin.jslib/replay-setting.js
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares the LensMCP runtime dependencies and contains no lifecycle hook.
- The plugin defaults to enabled, applies during Vite serving, and uses a loopback host for its bridge.
- The bridge and client runtime are same-version LensMCP packages; event mapping handles browser events, and the client runtime includes a session replay recorder.
- Core event storage defaults to a project-local LensMCP events file; no attack behavior was identified in the inspected source.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
9 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var Z=Object.defineProperty;var g=(e,n)=>Z(e,"name",{value:n,configurable:!0});var Q=Object.defineProperty,y=g((e,n)=>Q(e,"name",{value:n,configurable:!0}),"g"),ee=Obj...
L2: `);if(t!==D)return null;const u=f??e.wsPort??0,o=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:r,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11export function lensmcpVitePlugin(e={},n={}){const s=e.enabled??!0,p=e.wsHost??"127.0.0.1",a=e.injectClient??!0;let f,c,r;const l=X(n),m=e.aliasValtio??!0,R=e.transformSource??!0,b=e.applyOn
Low
Ai Review Evidence
The plugin defaults to enabled, applies during Vite serving, and uses a loopback host for its bridge.
lib/plugin.jsView on unpkg · L11async configureServer(t){if(!s)return;r=te(24).toString("base64url"),c=await le({host:p,port:e.wsPort??0,bus:n.bus,sessionId:n.sessionId,token:r,...e.wsAllowedOrigins?{allowedOrigins:e.wsAll
Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidence.lpm-dependency-evidence-62f08407-f2f2-4e4c-9849-fb02d1b2f19b/0/npm-linux/lib/server.js
LowAi Review Evidence.lpm-dependency-evidence-62f08407-f2f2-4e4c-9849-fb02d1b2f19b/0/npm-linux/lib/event-mappers.js
LowAi Review Evidence.lpm-dependency-evidence-62f08407-f2f2-4e4c-9849-fb02d1b2f19b/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-62f08407-f2f2-4e4c-9849-fb02d1b2f19b/0/npm-linux/index.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.18.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.