registry / @lensmcp/vite-plugin / 1.25.23
@lensmcp/vite-plugin@1.25.23
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe flagged dependency bridge is declared at a fixed version and its inspected exports and callers serve the Vite diagnostics runtime. Replay is configuration-controlled and uses the plugin’s local server endpoint; the inspected sources do not establish a concrete attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
Using the plugin in a Vite development server; replay requires its configuration or capture setting to enable it.
Impact
The inspected behavior supports local development diagnostics and replay; no unrelated recipient or concrete harmful action was established.
Mechanism
The plugin starts a local diagnostic bridge and can add a browser client that sends events to that server. The bridge converts events with redaction helpers, and core code can append events to a local file.
AI rationale
The flagged dependency bridge is declared at a fixed version and its inspected exports and callers serve the Vite diagnostics runtime. Replay is configuration-controlled and uses the plugin’s local server endpoint; the inspected sources do not establish a concrete attack surface.
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a Vite plugin entry and declares fixed-version LensMCP runtime dependencies.
- The plugin applies to Vite serve mode by default, and replay activation is controlled by configuration or capture settings.
- Bridge exports provide a local server and event conversion; event mapping imports redaction helpers.
- The client runtime package exposes an optional replay source, which posts recordings through its configured endpoint.
- Core exports runtime utilities, and its event writer appends events to a local file.
- The replay uploader posts through the configured endpoint with credentials omitted.
Evidence against
- Replay can be enabled by configuration and sends recorded browser events to the configured endpoint, but the inspected plugin constructs that endpoint from its local Vite server settings.
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
9 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11ce??!0,v=e.applyOnBuild??process.env.LENSMCP_VITE_APPLY_ON_BUILD==="1",k=ce(),b=d(()=>!!c&&de({...e.replay!==void 0?{option:e.replay}:{},captureFile:k}),"replayOn");return{name:"@lensmcp/vite-plugin",apply:d((t,u)=>s&&(u.command==="serve"||v),"apply"),enforce:"pre",wsPort:d(()=>f,"wsPort"),config(t){if(!s)return;const u=checkoutViteCacheDir(t?.root,t?.cacheDir);u&&console.log(`[lensmcp] node_modules is shared with an
Low
Ai Review Evidence
The plugin applies to Vite serve mode by default, and replay activation is controlled by configuration or capture settings.
lib/plugin.jsView on unpkg · L1package.json
Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencelib/plugin.js
LowAi Review Evidence.lpm-dependency-evidence-c30783fb-c791-4248-981c-640bc0817dcb/0/npm-linux/lib/event-mappers.js
LowAi Review Evidence.lpm-dependency-evidence-c30783fb-c791-4248-981c-640bc0817dcb/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-c30783fb-c791-4248-981c-640bc0817dcb/0/npm-linux/index.js
LowAi Review Evidence.lpm-dependency-evidence-c30783fb-c791-4248-981c-640bc0817dcb/1/npm-linux/package.json
LowAi Review Evidence
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.23.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.