registry / @lensmcp/vite-plugin / 1.25.29

@lensmcp/vite-plugin@1.25.29

LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The manifest and entry point match a Vite observability plugin, and the inspected runtime data flow targets a bridge that defaults to 127.0.0.1. Replay can capture browser sessions, but the source directs uploads to that configured bridge and provides an environment setting to disable replay; no unrelated network destination or harmful behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A project configures the plugin in Vite; replay capture runs when enabled by its setting.

Impact

The observed data flow supports the package's stated observability and replay purpose; no unrelated host or harmful action was identified.

Mechanism

The plugin injects browser instrumentation and sends events or replay data to the configured bridge endpoint, which defaults to loopback.

AI rationale

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exports the Vite plugin entry point and declares LensMCP bridge and instrumentation dependencies.
The entry point only re-exports plugin functions; the bridge starts from Vite's configureServer hook.
The bridge defaults to 127.0.0.1 and accepts a configurable host and port.
Session replay uploads use the configured bridge endpoint; replay can be disabled with LENSMCP_REPLAY=off.

Evidence against

When enabled, the plugin instruments app source and sends browser runtime events to its bridge.
Replay is enabled by default when no capture setting disables it, so recorded session data may be sent to the local bridge.

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsMinified

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 55.0 KB of source

Source & flagged code

7 flagged

lib/plugin.jsView file

1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import... L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm... L3: (() => {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/plugin.jsView on unpkg · L1

1host:p,port:e.wsPort??0,bus:n.bus,sessionId:n.sessionId,token:o,...e.wsAllowedOrigins?{allowedOrigins:e.wsAllowedOrigins}:{}}),f=c.port,t.middlewares.use(le(c));let u=b();se(k,{int

Low

Ai Review Evidence

The entry point only re-exports plugin functions; the bridge starts from Vite's configureServer hook.

lib/plugin.jsView on unpkg · L1

package.jsonView file

1{ "name": "@lensmcp/vite-plugin", "version": "1.25.29", "type": "module", "main": "./index.js", "module": "./index.js", "types": "./index.d.ts", "exports": { "./package.json": "./package.json",

Low

Suspicious Dependency Evidence

The manifest exports the Vite plugin entry point and declares LensMCP bridge and instrumentation dependencies.

package.jsonView on unpkg · L1

index.jsView file

1"use strict";export{lensmcpVitePlugin,handleClientEnvelope}from"./lib/plugin.js";export{envelopeToEvent}from"@lensmcp/bridge";

Low

Ai Review Evidence

The entry point only re-exports plugin functions; the bridge starts from Vite's configureServer hook.

index.jsView on unpkg · L1

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/0/npm-linux/lib/constants.jsView file

1"use strict";export const DEFAULT_WS_HOST="127.0.0.1",DEFAULT_WS_PORT=5747,ENV_WS_HOST="LENSMCP_WS_HOST",ENV_WS_PORT="LENSMCP_WS_PORT",ENV_SESSION_ID="LENSMCP_SESSION_ID",ENV_BRIDGE_ALLOWED_ORIGINS="LENSMCP_BRI

Low

Ai Review Evidence

The bridge defaults to 127.0.0.1 and accepts a configurable host and port.

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/0/npm-linux/lib/constants.jsView on unpkg · L1

lib/replay-setting.jsView file

1"use strict";var a=Object.defineProperty;var t=(r,e)=>a(r,"name",{value:e,configurable:!0});var i=Object.defineProperty,o=t((r,e)=>i(r,"name",{value:e,configurable:!0}),"t");import{readFileSync as p}from"node:fs";import{dirname as s,join as u}from"node:path";import{lensEventFile as c}from"@lensmcp/core/lens-events";export function replayEnabled(r){const e=(r.env??process.env).LENSMCP_REPLAY?.trim().toLowerCase();if(e==="0"||e==="off"||e==="false")return!1;if(e==="1"||e==="on"||e==="true")return!0;if(r.option!==void

Low

Ai Review Evidence

Session replay uploads use the configured bridge endpoint; replay can be disabled with LENSMCP_REPLAY=off.

lib/replay-setting.jsView on unpkg · L1

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/1/npm-linux/replay-source.jsView file

1endpoint}${t}?${n.toString()}`}async post(t,r,n){let s=await this.o.env.fetch(this.url(t,r),{method:"POST",headers:{"content-type":"text/plain"},body:n,credentials:"omit",keepalive:(typeof n=="string"?n.length:n.byteLength)<=this.

Low

Ai Review Evidence

Session replay uploads use the configured bridge endpoint; replay can be disabled with LENSMCP_REPLAY=off.

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/1/npm-linux/replay-source.jsView on unpkg · L1

Findings

1 High2 Medium7 Low

HighCopied Package Dependency Bridgelib/plugin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidenceindex.js

LowAi Review Evidencelib/plugin.js

LowAi Review Evidence.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/0/npm-linux/lib/constants.js

LowAi Review Evidencelib/replay-setting.js

LowAi Review Evidence.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/1/npm-linux/replay-source.js

Affected versions and remediation

This report applies to @lensmcp/vite-plugin@1.25.29.

See all versions of @lensmcp/vite-plugin for other recorded verdicts.

Review the evidence and your use of @lensmcp/vite-plugin@1.25.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 06:49:15.341Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @lensmcp/vite-plugin / 1.25.29

@lensmcp/vite-plugin@1.25.29

LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A project configures the plugin in Vite; replay capture runs when enabled by its setting.

Impact

The observed data flow supports the package's stated observability and replay purpose; no unrelated host or harmful action was identified.

Mechanism

The plugin injects browser instrumentation and sends events or replay data to the configured bridge endpoint, which defaults to loopback.

AI rationale

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exports the Vite plugin entry point and declares LensMCP bridge and instrumentation dependencies.
The entry point only re-exports plugin functions; the bridge starts from Vite's configureServer hook.
The bridge defaults to 127.0.0.1 and accepts a configurable host and port.
Session replay uploads use the configured bridge endpoint; replay can be disabled with LENSMCP_REPLAY=off.

Evidence against

When enabled, the plugin instruments app source and sends browser runtime events to its bridge.
Replay is enabled by default when no capture setting disables it, so recorded session data may be sent to the local bridge.

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsMinified

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 55.0 KB of source

Source & flagged code

7 flagged

lib/plugin.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/plugin.jsView on unpkg · L1

1host:p,port:e.wsPort??0,bus:n.bus,sessionId:n.sessionId,token:o,...e.wsAllowedOrigins?{allowedOrigins:e.wsAllowedOrigins}:{}}),f=c.port,t.middlewares.use(le(c));let u=b();se(k,{int

Low

Ai Review Evidence

The entry point only re-exports plugin functions; the bridge starts from Vite's configureServer hook.

lib/plugin.jsView on unpkg · L1

package.jsonView file

1{ "name": "@lensmcp/vite-plugin", "version": "1.25.29", "type": "module", "main": "./index.js", "module": "./index.js", "types": "./index.d.ts", "exports": { "./package.json": "./package.json",

Low

Suspicious Dependency Evidence

The manifest exports the Vite plugin entry point and declares LensMCP bridge and instrumentation dependencies.

package.jsonView on unpkg · L1

index.jsView file

1"use strict";export{lensmcpVitePlugin,handleClientEnvelope}from"./lib/plugin.js";export{envelopeToEvent}from"@lensmcp/bridge";

Low

Ai Review Evidence

The entry point only re-exports plugin functions; the bridge starts from Vite's configureServer hook.

index.jsView on unpkg · L1

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/0/npm-linux/lib/constants.jsView file

Low

Ai Review Evidence

The bridge defaults to 127.0.0.1 and accepts a configurable host and port.

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/0/npm-linux/lib/constants.jsView on unpkg · L1

lib/replay-setting.jsView file

Low

Ai Review Evidence

Session replay uploads use the configured bridge endpoint; replay can be disabled with LENSMCP_REPLAY=off.

lib/replay-setting.jsView on unpkg · L1

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/1/npm-linux/replay-source.jsView file

Low

Ai Review Evidence

Session replay uploads use the configured bridge endpoint; replay can be disabled with LENSMCP_REPLAY=off.

.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/1/npm-linux/replay-source.jsView on unpkg · L1

Findings

1 High2 Medium7 Low

HighCopied Package Dependency Bridgelib/plugin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidenceindex.js

LowAi Review Evidencelib/plugin.js

LowAi Review Evidence.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/0/npm-linux/lib/constants.js

LowAi Review Evidencelib/replay-setting.js

LowAi Review Evidence.lpm-dependency-evidence-1fd38835-5db0-45a0-b543-0b26bb49c9bb/1/npm-linux/replay-source.js

Affected versions and remediation

This report applies to @lensmcp/vite-plugin@1.25.29.

See all versions of @lensmcp/vite-plugin for other recorded verdicts.

Review the evidence and your use of @lensmcp/vite-plugin@1.25.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 06:49:15.341Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @lensmcp

Related packages

More from @lensmcp