registry / @lensmcp/vite-plugin / 1.25.25
@lensmcp/vite-plugin@1.25.25
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe inspected entry points and event mapping support the package's stated Vite observability function. Replay transport and local event storage are present, but the reviewed source does not establish an unrelated recipient or other concrete attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user configures and runs the Vite plugin.
Impact
The inspected source does not establish credential theft, unrelated data disclosure, or another concrete attack.
Mechanism
The plugin connects browser runtime events to the LensMCP bridge and event handling code.
AI rationale
The inspected entry points and event mapping support the package's stated Vite observability function. Replay transport and local event storage are present, but the reviewed source does not establish an unrelated recipient or other concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a Vite plugin entry point and declares LensMCP bridge and runtime dependencies.
- The bridge exports server and event-handling functions as a separate package entry point.
- The event mapper converts client console events into runtime event records.
- Replay uploads use the configured fetch transport; the inspected source does not establish an unrelated publisher-controlled recipient.
- The core event helper appends events to a configured file, with size and file-count limits.
- The reviewed plugin and dependency entry points show product runtime exports and local event handling; no attack behavior was identified.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
9 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1package.jsonView file
1{
"name": "@lensmcp/vite-plugin",
"version": "1.25.25",
"type": "module",
"main": "./index.js",
"module": "./index.js",
"types": "./index.d.ts",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./index.d.ts",
"import": "./index.js",
"default": "./index.js"
}
},
"dependencies": {
"@babel/core": "^7.0.0",
"@
Low
Suspicious Dependency Evidence
The package exposes a Vite plugin entry point and declares LensMCP bridge and runtime dependencies.
package.jsonFindings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-583fed13-0288-4b02-b2fe-a46535b179c3/0/npm-linux/lib/event-mappers.js
LowAi Review Evidence.lpm-dependency-evidence-583fed13-0288-4b02-b2fe-a46535b179c3/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-583fed13-0288-4b02-b2fe-a46535b179c3/0/npm-linux/index.js
LowAi Review Evidence.lpm-dependency-evidence-583fed13-0288-4b02-b2fe-a46535b179c3/1/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-583fed13-0288-4b02-b2fe-a46535b179c3/1/npm-linux/replay-source.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.25.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.