registry / @lensmcp/vite-plugin / 1.25.32
@lensmcp/vite-plugin@1.25.32
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package starts a token-protected bridge as part of Vite server configuration, defaulting to 127.0.0.1, and replay behavior follows local settings or explicit configuration. The reviewed sources show no install-time contact, credential exfiltration, or unrelated external destination.
Static reason
One or more suspicious static signals were detected.
Trigger
Vite server configuration starts the bridge; browser instrumentation is injected when the plugin is enabled.
Impact
Captured development and browser telemetry is available to the configured LensMCP receiver; the reviewed code does not show credential theft or an unrelated external destination.
Mechanism
The bridge defaults to loopback and uses a generated token. Replay uploads go to the configured endpoint without browser credentials.
AI rationale
The package starts a token-protected bridge as part of Vite server configuration, defaulting to 127.0.0.1, and replay behavior follows local settings or explicit configuration. The reviewed sources show no install-time contact, credential exfiltration, or unrelated external destination.
Evidence
capture.json.lensmcp/cache/vite
Network endpoints2
127.0.0.1Configured wsHost or replay endpoint
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry exports the Vite plugin from its own index.js module.
- The bridge is created during Vite server configuration and receives the plugin's configured host, a generated token, and optional allowed origins.
- The bridge's default host is 127.0.0.1; its host and port can be configured through environment variables.
- Replay behavior is controlled by LENSMCP_REPLAY, the plugin option, or the local capture settings.
- Replay uploads use the configured endpoint and omit browser credentials.
Evidence against
- The plugin injects browser instrumentation and can capture application events, including session replay when enabled by its settings.
- The host can be overridden, so a user configuration can direct the bridge away from loopback.
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
6 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11c=await ie({host:p,port:e.wsPort??0,bus:n.bus,sessionId:n.sessionId,token:o,...e.wsAllowedOrigins?{allowedOrigins:e.wsAllowedOrigins}:{}}),f=c.port,t.middlewares.use(le(c));let u=b
Low
Ai Review Evidence
The bridge is created during Vite server configuration and receives the plugin's configured host, a generated token, and optional allowed origins.
lib/plugin.jsView on unpkg · L1index.jsView file
Findings
1 High2 Medium6 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review Evidenceindex.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidence.lpm-dependency-evidence-72249f6e-d230-4892-8891-1797204f1a79/0/npm-linux/lib/constants.js
LowAi Review Evidencelib/replay-setting.js
LowAi Review Evidence.lpm-dependency-evidence-72249f6e-d230-4892-8891-1797204f1a79/1/npm-linux/lib/replay/uploader.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.32.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.