registry / @lensmcp/vite-plugin / 1.25.8
@lensmcp/vite-plugin@1.25.8
LensMCP Vite plugin — valtio alias, source transform, and browser event bridge.
AI Security Review
scanned 16d ago · by lpm-firewall-aiSource inspection shows a Vite development observability plugin whose runtime reports diagnostics to a tokenized bridge, defaulting to loopback. The scanner signals align with this functionality; no malicious behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
A project configures and runs the plugin in Vite serve mode.
Impact
No external disclosure, credential transfer, or unauthorized account action was established.
Mechanism
The injected runtime sends diagnostic events over a tokenized WebSocket to the configured bridge; console values are bounded.
AI rationale
Source inspection shows a Vite development observability plugin whose runtime reports diagnostics to a tokenized bridge, defaulting to loopback. The scanner signals align with this functionality; no malicious behavior was established.
Evidence
package.jsonindex.jslib/plugin.js
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points its main and import entrypoints to index.js.
- The plugin runs in Vite serve mode and defaults its bridge host to loopback; it creates the bridge with a generated token and optional origin restrictions.
- The injected browser client sends diagnostic events, including console data and fetch metadata, over its WebSocket; console values are bounded.
Evidence against
- The inspected manifest declares no lifecycle scripts. The runtime source shows no credential collection or external telemetry recipient.
Behavioral surface
EnvironmentVars
HighEntropyStringsMinified
Source & flagged code
9 flaggedlib/plugin.jsView file
1package = @lensmcp/vite-plugin; repositoryIdentity = lensmcp; dependency = @babel/core
L1: "use strict";var $=Object.defineProperty;var g=(e,t)=>$(e,"name",{value:t,configurable:!0});var G=Object.defineProperty,u=g((e,t)=>G(e,"name",{value:t,configurable:!0}),"d");import...
L2: (() => {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/plugin.jsView on unpkg · L11wsHost??"127.0.0.1",i=e.injectClient??!0;let p,c,o;const l=x(t),f=e.aliasValtio??!0,S=e.transformSource??!0,v=e.applyOnBuild??process.env.LENSMCP_VITE_APPLY_ON_BUILD==="1";return{name:"@lensmcp/vite-plugin",apply:u((n,a)=>r&&(a.command==="serve"||v),"apply"),enforce:"pre",wsPort:u(()=>p,"wsPort"),config(n){if(!r)return;const a=checkoutViteCacheDir(n?.root,n?.cacheDir);a&&console.log(`[lensmcp] node_modules is shared with another checkout \u2014 Vite's dependency cache moves to ${a}`),process.env.LENSMCP_FREEZE==="1"&&(console.log("[lensmcp] frozen worktree instance \u2014 Vite watches no files
Low
Ai Review Evidence
The plugin runs in Vite serve mode and defaults its bridge host to loopback; it creates the bridge with a generated token and optional origin restrictions.
lib/plugin.jsView on unpkg · L11
Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgelib/plugin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
LowAi Review Evidencelib/plugin.js
Affected versions and remediation
This report applies to @lensmcp/vite-plugin@1.25.8.
See all versions of @lensmcp/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @lensmcp/vite-plugin@1.25.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.