registry / @lensmcp/vite-plugin / 1.25.47
@lensmcp/vite-plugin@1.25.47
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe entry point exports a Vite plugin, and the inspected runtime behavior is centered on serving an authenticated local event bridge and collecting browser observability data. The environment-variable references control build or watch behavior, with no evidence they are collected or sent to an unrelated host.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Vite development-server configuration; build instrumentation is opt-in through applyOnBuild or LENSMCP_VITE_APPLY_ON_BUILD=1.
Impact
No malicious impact identified in the inspected source.
Mechanism
Starts a token-protected WebSocket bridge on 127.0.0.1 by default and injects client instrumentation that reports events to it.
AI rationale
The entry point exports a Vite plugin, and the inspected runtime behavior is centered on serving an authenticated local event bridge and collecting browser observability data. The environment-variable references control build or watch behavior, with no evidence they are collected or sent to an unrelated host.
Network endpoints1
ws://127.0.0.1:<port> (local bridge; host is configurable)
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package metadata identifies it as a Vite plugin and exposes index.js as its entry point; it declares no lifecycle scripts.
- The plugin starts its bridge when Vite configures a development server, using 127.0.0.1 by default and a generated token; it instruments browser events for that bridge.
- Environment variables are used for build settings and optional extra watch roots; no automatic collection or transmission of their values was identified.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
6 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var z=Object.defineProperty;var g=(e,n)=>z(e,"name",{value:n,configurable:!0});var Z=Object.defineProperty,d=g((e,n)=>Z(e,"name",{value:n,configurable:!0}),"c");import...
L2: `);if(t!==B)return null;const u=f??e.wsPort??0,r=process.env.LENSMCP_APP||process.env.NX_TASK_TARGET_PROJECT;return buildInlineClientRuntime({host:p,port:u,token:o,hmrRecovery:e.hm...
L3: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1•matchType = malicious_source_fingerprint_signature
signature = 118688338f0ed54a
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @lensmcp/vite-plugin@1.25.44
matchedPath = lib/plugin.js
matchedIdentity = npm:QGxlbnNtY3Avdml0ZS1wbHVnaW4:1.25.44
similarity = 1.000
shingleOverlap = 5
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
lib/plugin.jsView on unpkg1process.env.LENSMCP_VITE_APPLY_ON_BUILD==="1",k=ce(),b=d(()=>!!c&&de({...e.replay!==void 0?{option:e.replay}:{},captureFile:k}),"replayOn");return{name:"@lensmcp/vite-plugin",apply:d((t,u)=>s&&(u.command==="serve"||v),"apply"),enforce:"pre",wsPort:d(()=>f,"wsPort"),config(t){if(!s)return;const u=checkoutViteCacheDir(t?.root,t?.cacheDir);u&&console.log(`[lensmcp] node_modules is shared with another checkout \u2014 Vit
Findings
2 High2 Medium5 Low
HighCopied Package Dependency Bridgelib/plugin.js
HighKnown Malware Source Fingerprint Signaturelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.47.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.47 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.