registry / @lensmcp/vite-plugin / 1.25.46
@lensmcp/vite-plugin@1.25.46
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install scripts, and its entry point only exports plugin functions. Runtime instrumentation is activated when Vite configures the plugin and connects to a bridge that defaults to loopback, consistent with the package's stated purpose.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
The application imports and configures the plugin in Vite; it is enabled by default for serve mode.
Impact
The bridge receives app runtime and build diagnostics for LensMCP observability; no unrelated collector or malicious behavior was identified.
Mechanism
The plugin injects a browser client and starts a WebSocket bridge on the configured host and port, defaulting to loopback.
AI rationale
The package has no install scripts, and its entry point only exports plugin functions. Runtime instrumentation is activated when Vite configures the plugin and connects to a bridge that defaults to loopback, consistent with the package's stated purpose.
Network endpoints1
127.0.0.1 (default bridge host)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata exposes index.js and lists dependencies but defines no install lifecycle scripts.
- The entry point exports the Vite plugin and event handler; it does not invoke them on import.
- The plugin applies to Vite serve mode by default, starts its bridge during configureServer, and gates build use behind an option or environment variable.
- The bridge defaults to 127.0.0.1 and listens on the configured host and port.
Evidence against
- When enabled in Vite, the plugin instruments application code and sends runtime events through a browser client; this is consistent with its stated observability purpose.
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
7 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1•matchType = malicious_source_fingerprint_signature
signature = 118688338f0ed54a
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @lensmcp/vite-plugin@1.25.44
matchedPath = lib/plugin.js
matchedIdentity = npm:QGxlbnNtY3Avdml0ZS1wbHVnaW4:1.25.44
similarity = 1.000
shingleOverlap = 5
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
lib/plugin.jsView on unpkg1On");return{name:"@lensmcp/vite-plugin",apply:d((t,u)=>s&&(u.command==="serve"||v),"apply"),enforce:"pre",wsPort:d(()=>f,"wsPort"),config(t){if(!s)return;const u=checkoutViteCacheDir(t?.root,t?.cacheDir);u&&console.log(`[lensmcp] node_modules is shared with another checkout \u2014 Vite's dependency cache moves to ${u}`),process.env.LENSMCP_FREEZE==="1"&&(console.log("[lensmcp] frozen worktree instance \u2014 Vite watches no files"),t&&(t.server={...t.server,watch:null}));const r={...u?{cacheDir:u}:{}};return m?{...r,resolve:{alias:[{find:/^valtio$/,replacement:"@lensmcp/valtio-instrumentation"
Findings
2 High2 Medium6 Low
HighCopied Package Dependency Bridgelib/plugin.js
HighKnown Malware Source Fingerprint Signaturelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidence.lpm-dependency-evidence-d5232706-ad36-470d-b283-159545859d3f/0/npm-linux/lib/server.js
LowAi Review Evidence.lpm-dependency-evidence-d5232706-ad36-470d-b283-159545859d3f/0/npm-linux/lib/constants.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.46.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.