registry / @lensmcp/vite-plugin / 1.25.45
@lensmcp/vite-plugin@1.25.45
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected code implements the package’s stated Vite observability purpose and defaults its bridge to loopback. Session replay is enabled by default but documented with controls to turn it off; no malicious collection or unrelated destination was identified.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
When a user adds the plugin to a Vite app and starts the development server; replay follows its documented settings.
Impact
Application events and replay data are made available to the configured LensMCP runtime; this matches the package’s stated purpose.
Mechanism
Injects browser instrumentation and sends events and replay data to the LensMCP bridge, which defaults to loopback.
AI rationale
The inspected code implements the package’s stated Vite observability purpose and defaults its bridge to loopback. Session replay is enabled by default but documented with controls to turn it off; no malicious collection or unrelated destination was identified.
Network endpoints1
127.0.0.1 (default bridge host; port and host are configurable)
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata points to index.js, which exports the Vite plugin and bridge event mapper.
- The README describes browser observability events sent to LensMCP as the package’s purpose.
- The API documents session replay, its default behavior, and controls to disable or configure it.
- The plugin defaults its bridge host to 127.0.0.1; the host is configurable.
Evidence against
- When enabled, the plugin captures browser events and session replay, which can include application content.
- Replay defaults on unless disabled through the documented option, environment variable, or capture settings.
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
7 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1•matchType = malicious_source_fingerprint_signature
signature = 118688338f0ed54a
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @lensmcp/vite-plugin@1.25.44
matchedPath = lib/plugin.js
matchedIdentity = npm:QGxlbnNtY3Avdml0ZS1wbHVnaW4:1.25.44
similarity = 1.000
shingleOverlap = 5
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
lib/plugin.jsView on unpkg1}){const s=e.enabled??!0,p=e.wsHost??"127.0.0.1",a=e.injectClient??!0;let f,c,o;const l=V(n),m=e.aliasValtio??!0,S=e.transformSource??!0,v=e.applyOnBuild??process.env.LENSMCP_VITE_APPLY_ON_BUILD==="1",k=ce(),b=d(()=>!!c&&de({...e.replay!==void 0?{option:e.replay}:{},captureFile:k}),"replayOn");return{name:"@lensmcp/vite-plugin",apply:d((t
Findings
2 High2 Medium6 Low
HighCopied Package Dependency Bridgelib/plugin.js
HighKnown Malware Source Fingerprint Signaturelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review EvidenceREADME.md
LowAi Review Evidencelib/types.d.ts
LowAi Review Evidencelib/plugin.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.45.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.