@lensmcp/vite-plugin@1.25.7
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 16d ago · by lpm-firewall-aiSource inspection found a Vite plugin that serves an injected observability client during development and sends fetch metadata through a bridge defaulting to loopback. The manifest has no lifecycle scripts, and no unrelated credential recipient or concrete attack behavior was found.
Decision evidence
public snapshot- The manifest points package imports to index.js and declares aligned LensMCP runtime dependencies.
- The plugin defaults its WebSocket host to loopback and applies during Vite serve by default.
- The injected client sends fetch metadata through the bridge; no unrelated recipient or credential transfer was identified.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L1The plugin defaults its WebSocket host to loopback and applies during Vite serve by default.
lib/plugin.jsView on unpkg · L1The plugin defaults its WebSocket host to loopback and applies during Vite serve by default.
Findings
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.7.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.