registry / @lensmcp/vite-plugin / 1.25.34
@lensmcp/vite-plugin@1.25.34
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found no malicious behavior: the package exposes a Vite plugin, and the reviewed bridge and replay paths serve its local observability function. The scanner's dependency-bridge signal is consistent with the declared runtime bridge dependency and package entrypoint.
Static reason
One or more suspicious static signals were detected.
Trigger
A project configures the plugin in a Vite development server; replay follows the plugin's replay setting.
Impact
The reviewed source does not establish an attack surface beyond the plugin's intended local development and observability behavior.
Mechanism
The plugin injects a browser client and can route replay data to its local bridge using the page's native fetch with credentials omitted.
AI rationale
Source inspection found no malicious behavior: the package exposes a Vite plugin, and the reviewed bridge and replay paths serve its local observability function. The scanner's dependency-bridge signal is consistent with the declared runtime bridge dependency and package entrypoint.
Evidence
package.jsonindex.jslib/plugin.jslib/replay-setting.js.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/0/npm-linux/package.json.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/0/npm-linux/index.js.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/0/npm-linux/lib/event-mappers.js.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/1/npm-linux/package.json.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/1/npm-linux/replay-source.js.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/2/npm-linux/package.json.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/2/npm-linux/index.js.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/2/npm-linux/lib/lens-events.js
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entrypoint exports a Vite plugin and its client-envelope handler; the inspected manifest declares the LensMCP bridge and runtime dependencies.
- The plugin starts its bridge when Vite configures a server and serves a generated browser client; replay uses the local bridge endpoint and sends recordings with credentials omitted.
- Replay activation is controlled by configuration or the LENSMCP_REPLAY environment setting, and the bridge and runtime dependencies expose the expected plugin functionality.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
9 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1package.jsonView file
1{
"name": "@lensmcp/vite-plugin",
"version": "1.25.34",
"type": "module",
"main": "./index.js",
"module": "./index.js",
"types": "./index.d.ts",
"exports": {
"./package.json": "./package.json",
".": {
"types": ".
Low
Suspicious Dependency Evidence
The package entrypoint exports a Vite plugin and its client-envelope handler; the inspected manifest declares the LensMCP bridge and runtime dependencies.
package.jsonView on unpkg · L1Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/0/npm-linux/lib/event-mappers.js
LowAi Review Evidence.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/0/npm-linux/index.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/1/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-f0be21dc-ab21-45a5-bdf7-75c5444a7ec4/1/npm-linux/replay-source.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.34.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.