registry / @lensmcp/vite-plugin / 1.25.27
@lensmcp/vite-plugin@1.25.27
⚠ Under reviewLensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe available source shows a Vite observability plugin with browser instrumentation and a replay uploader, but critical bridge and core runtime dependencies are unresolved. Their event handling and effective replay destination cannot be verified from this snapshot, so the risk remains unresolved.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package and using its Vite plugin can activate the runtime; replay behavior depends on its setting and configuration.
Impact
The unavailable runtime code prevents determining whether captured events or replay data leave the local development environment and how they are handled.
Mechanism
The plugin imports missing bridge and core dependencies, while the inspected replay sender posts captured data to a configured endpoint whose selection is not established here.
AI rationale
The available source shows a Vite observability plugin with browser instrumentation and a replay uploader, but critical bridge and core runtime dependencies are unresolved. Their event handling and effective replay destination cannot be verified from this snapshot, so the risk remains unresolved.
Evidence
package.jsonindex.jslib/plugin.jslib/replay-setting.js.lpm-dependency-evidence-422b8ae3-0fe0-44e9-962d-5dcabb37c182/1/npm-linux/replay-source.js.lpm-dependency-evidence-422b8ae3-0fe0-44e9-962d-5dcabb37c182/1/npm-linux/package.json
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @lensmcp/bridge and @lensmcp/core as runtime dependencies, and the exported entrypoint imports the plugin and bridge.
- The plugin imports bridge server and event handling functions from @lensmcp/bridge; that dependency's source is unavailable in this snapshot.
- Replay activation reads LENSMCP_REPLAY and a capture setting; the effective default and destination behavior depend on missing package code and configuration.
- The inspected replay sender posts recording data to its configured endpoint, but this excerpt does not establish how the endpoint is selected or who receives it.
- The inspected client-runtime manifest has no scripts field; its replay source is present for inspection. The selected @babel/core snapshot identifies itself as Babel compiler core.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
7 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11e,createBridgeServer as ie,makePublisher as V,handleClientEnvelope as ae}from"@lensmcp/bridge";import{CLIENT_VIRTUAL_ID as j,createRuntimeModuleGuard as le,REPLAY_VIRTUAL_ID as U,RESOLVED_CL
Low
Suspicious Dependency Evidence
The plugin imports bridge server and event handling functions from @lensmcp/bridge; that dependency's source is unavailable in this snapshot.
lib/plugin.jsView on unpkg · L1package.jsonView file
Findings
1 High2 Medium7 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidenceindex.js
LowSuspicious Dependency Evidencelib/plugin.js
LowAi Review Evidencelib/replay-setting.js
LowAi Review Evidence.lpm-dependency-evidence-422b8ae3-0fe0-44e9-962d-5dcabb37c182/1/npm-linux/replay-source.js
LowAi Review Evidence.lpm-dependency-evidence-422b8ae3-0fe0-44e9-962d-5dcabb37c182/3/npm-linux/package.json
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.27.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.