registry / @lensmcp/vite-plugin / 1.25.24
@lensmcp/vite-plugin@1.25.24
⚠ Under reviewLensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe visible source shows normal Vite plugin activation and no install hook, but the active entrypoint imports the unavailable bridge package and plugin code starts its server. Review those runtime dependencies before reaching a clean or malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer starts Vite with this plugin enabled.
Impact
The available source does not establish malicious behavior, but the uninspected runtime dependencies prevent clearing the package.
Mechanism
The plugin starts a bridge server and serves an injected browser runtime; the bridge implementation and runtime source were unavailable for inspection.
AI rationale
The visible source shows normal Vite plugin activation and no install hook, but the active entrypoint imports the unavailable bridge package and plugin code starts its server. Review those runtime dependencies before reaching a clean or malicious verdict.
Evidence
package.jsonindex.jslib/plugin.js
Decision evidence
public snapshotAI called this Manual Review at 83.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package entrypoint loads the plugin and imports the bridge package.
- The Vite server hook starts a bridge server and serves a generated browser client runtime.
- The bridge and client runtime are declared runtime dependencies, but their source was unavailable for inspection.
Evidence against
- The manifest declares no lifecycle scripts; the plugin activates through Vite's serve command, with build activation disabled by default.
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
6 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11from"@lensmcp/core";import{BRIDGE_TOKEN_PARAM as re,createBridgeServer as ie,makePublisher as V,handleClientEnvelope as ae}from"@lensmcp/bridge";import{CLIENT_VIRTUAL_ID as j,createRuntimeModuleGuard as le,REPLAY_VIRTUAL_ID as U,RESOLVED_CLIENT_VIRTUAL_ID as B,RESOLVED_REPLAY_VIRTUAL_ID as $}from"./runtime-guard.js";import{captureFilePath as ce,replayEnabled
Low
Ai Review Evidence
The package entrypoint loads the plugin and imports the bridge package.
lib/plugin.jsView on unpkg · L11ktree instance \u2014 Vite watches no files"),t&&(t.server={...t.server,watch:null}));const r={...u?{cacheDir:u}:{}};return m?{...r,resolve:{alias:[{find:/^valtio$/,replacement:"@lensmcp/valtio-instrumentation"}]}}:Object.keys(r).length?r:void 0},async configureServer(t){if(!s)return;o=Q(24).toString("base64url"),c=await ie({host:p,port:e.wsPort??0,bus:n.bus,sessionId:n.sessionId,token:o,...e.wsAllowedOrigins?{allowedOrigins:e.wsAllowedOrigins}:{}}),f=c.port,t.middlewares.use(le(c));let u=b();se
Findings
1 High2 Medium6 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review Evidenceindex.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowSuspicious Dependency Evidencepackage.json
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.24.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.