registry / @lensmcp/vite-plugin / 1.25.38
@lensmcp/vite-plugin@1.25.38
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source behavior matches the package's documented purpose: instrumenting a Vite development app and streaming its observations to LensMCP through a local bridge. Replay is enabled by default but is part of the documented observability configuration and can be disabled; no unrelated endpoint or harmful action was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing and configuring the plugin in Vite; its bridge starts when Vite serves the app.
Impact
Captured frontend diagnostics and replay data are available to the local LensMCP bridge; no unrelated collector or harmful behavior was identified.
Mechanism
Injects an observability client and optionally session replay, with a local WebSocket/HTTP bridge. The README documents event streaming as the package's purpose, and replay has configuration controls.
AI rationale
The source behavior matches the package's documented purpose: instrumenting a Vite development app and streaming its observations to LensMCP through a local bridge. Replay is enabled by default but is part of the documented observability configuration and can be disabled; no unrelated endpoint or harmful action was found.
Network endpoints1
127.0.0.1 (default bridge host; port is selected or configured)
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The README describes the package as a Vite observability plugin that streams frontend events to LensMCP, matching its stated purpose.
- The plugin attaches to Vite's serve command by default and starts its bridge on the configured host, defaulting to 127.0.0.1.
- Replay can be disabled with LENSMCP_REPLAY=0/off/false or the replay option; replay data is addressed to the local bridge.
Evidence against
- The README says the plugin's capabilities are on by default, and the replay setting defaults to enabled when no setting or capture-file opt-out is present.
- The plugin instruments frontend events and can record session replay, which may include application page content and user interactions.
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
5 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11ce??!0,v=e.applyOnBuild??process.env.LENSMCP_VITE_APPLY_ON_BUILD==="1",k=ce(),b=d(()=>!!c&&de({...e.replay!==void 0?{option:e.replay}:{},captureFile:k}),"replayOn");return{name:"@lensmcp/vite-plugin",apply:d((t,u)=>s&&(u.command==="serve"||v),"apply"),enforce:"pre",wsPort:d(()=>f,"wsPort"),config(t){if(!s)return;const u=checkoutViteCacheDir(t?.root,t?.cacheDir);u&&console.log(`[lensmcp] node_modules is shared with another checkout \u2014 Vite's dependency cache moves to ${u}`),process.env.LENSMCP_FREEZE==="1"&&(console.log("[lensmcp] frozen worktree instance \u2014 Vite watches no files"),t&&(
Low
Ai Review Evidence
The plugin attaches to Vite's serve command by default and starts its bridge on the configured host, defaulting to 127.0.0.1.
lib/plugin.jsView on unpkg · L1Findings
1 High2 Medium5 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review EvidenceREADME.md
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/replay-setting.js
LowAi Review Evidencelib/plugin.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.38.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.