@lensmcp/vite-plugin@1.25.21
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 14d ago · by lpm-firewall-aiInspected source supports a package-aligned Vite observability plugin: the entrypoint exposes the plugin and bridge, the default bridge host is loopback, and replay transmission uses an explicitly configured endpoint without browser credentials. The scanner's dependency bridge and environment-variable signals match the plugin's described function; no concrete malicious behavior was established.
Decision evidence
public snapshot- The manifest points to the Vite plugin entrypoint and declares the bridge and client runtime as package dependencies; it has no lifecycle script.
- The plugin defaults its WebSocket host to loopback and starts the bridge when Vite configures a development server.
- Replay capture posts to the configured endpoint with credentials omitted; the plugin uses replay settings and the local bridge for capture.
- The bridge and client runtime are LensMCP components, and the core package includes local event-file handling. The inspected event mapper converts client events into runtime events.
- No package-controlled external recipient, credential harvesting, or install-time execution was identified in the inspected source.
Source & flagged code
9 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1The plugin defaults its WebSocket host to loopback and starts the bridge when Vite configures a development server.
lib/plugin.jsView on unpkg · L1The manifest points to the Vite plugin entrypoint and declares the bridge and client runtime as package dependencies; it has no lifecycle script.
package.jsonView on unpkg · L2Replay capture posts to the configured endpoint with credentials omitted; the plugin uses replay settings and the local bridge for capture.
.lpm-dependency-evidence-8b9551ed-852d-438c-8127-454face159db/1/npm-linux/replay-source.jsView on unpkg · L1Replay capture posts to the configured endpoint with credentials omitted; the plugin uses replay settings and the local bridge for capture.
lib/replay-setting.jsView on unpkg · L1The bridge and client runtime are LensMCP components, and the core package includes local event-file handling. The inspected event mapper converts client events into runtime events.
.lpm-dependency-evidence-8b9551ed-852d-438c-8127-454face159db/0/npm-linux/lib/event-mappers.jsView on unpkg · L2The bridge and client runtime are LensMCP components, and the core package includes local event-file handling. The inspected event mapper converts client events into runtime events.
.lpm-dependency-evidence-8b9551ed-852d-438c-8127-454face159db/0/npm-linux/package.jsonView on unpkg · L2The bridge and client runtime are LensMCP components, and the core package includes local event-file handling. The inspected event mapper converts client events into runtime events.
.lpm-dependency-evidence-8b9551ed-852d-438c-8127-454face159db/0/npm-linux/index.jsView on unpkg · L1The bridge and client runtime are LensMCP components, and the core package includes local event-file handling. The inspected event mapper converts client events into runtime events.
.lpm-dependency-evidence-8b9551ed-852d-438c-8127-454face159db/1/npm-linux/package.jsonView on unpkg · L2Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.21.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.