registry / @pisell/pisellos / 2.1.176
@pisell/pisellos@2.1.176
一个可扩展的前端模块化SDK框架，支持插件系统
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a Pisell POS frontend SDK. Scanner malware labels come from default Feishu ScanOrder logging and a window setTimeout eval fallback, both package-aligned and user-invoked, with no install hook or secret theft.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Not activated by npm install or a bare import. ScanOrder or VenueBooking initialize in the host app can post logs; string timers would have to be used for eval.
Impact
No supply-chain install compromise is established. Remaining behavior is product SDK telemetry and dual-use timer evaluation.
Mechanism
First-party operational logging and browser polyfill
AI rationale
This is a Pisell POS frontend SDK. Scanner malware labels come from default Feishu ScanOrder logging and a window setTimeout eval fallback, both package-aligned and user-invoked, with no install hook or secret theft.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- ScanOrder initialize defaults to a named Feishu logger and posts method traces to hardcoded bot webhook URLs.
- Window plugins eval string timer handlers only in a setTimeout fallback when global timers are missing.
- package.json lists prepublishOnly, which scanners treat as a lifecycle script.
Evidence against
- There is no preinstall, install, or postinstall hook; prepublishOnly only runs npm run build.
- Feishu posting is overridable ScanOrder and VenueBooking ops logging, not env, file, or secret harvesting; grafana.example.com is an unused placeholder.
- eval is a string-timer polyfill; new Function evaluates product rule expressions.
- Import does not start network work; logging runs only if the host app initializes those solutions.
- window.js malware-similarity is the polyfill eval pattern, not a hidden payload.
- Login passwords go to relative /auth routes; Facebook, Apple, and jsdelivr URLs are product login and icon loading.
Behavioral surface
EnvironmentVarsEvalNetwork
Source & flagged code
5 flagged · loading sourcedist/plugins/window.jsView file
•matchType = normalized_sha256
matchedPackage = @pisell/pisellos@2.1.175
matchedPath = dist/plugins/window.js
matchedIdentity = npm:QHBpc2VsbC9waXNlbGxvcw:2.1.175
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/plugins/window.jsView on unpkg248} else {
L249: eval(handler);
L250: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/plugins/window.jsView on unpkg · L248dist/solution/ScanOrder/index.jsView file
•Default hardcoded logging webhook in dist/solution/ScanOrder/index.js:
var loggerConfig = ((_this4$otherParams2 = _this4.otherParams) === null || _this4$otherParams2 === void 0 ? void 0 : _this4$otherParams2.scanOrderLoggerConfig) || {
webhook: 'https://open.feishu.cn/open-apis/bot/v2/hook/216b3fe6-af98-424e-8706-f0471241a7ed',
errorHook: 'https://open.feishu.cn/open-apis/bot/v2/hook/015b7c2a-dd3c-4c30-9898-ef0f5253111f'
providerConfig: loggerConfig,
Rich runtime records posted to the webhook in [redacted].js:
var context = record.context || {};
text: "\u65E5\u5FD7\u5185\u5BB9: ".concat(safeStringify(record.payload), "\n")
text: "\u6269\u5C55\u4FE1\u606F: ".concat(safeStringify(record.extra), "\n")
return fetch(webhook, {
Reachable runtime logger calls in dist/modules/Order/index.js:
this.
Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/solution/ScanOrder/index.js
HighSemantic Analysis Limitedlib/solution/RegisterAndLogin/utils.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/plugins/window.js
HighKnown Malware Source Similaritylib/plugins/window.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/plugins/window.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @pisell/pisellos@2.1.176.
See all versions of @pisell/pisellos for other recorded verdicts.
- Review the evidence and your use of @pisell/pisellos@2.1.176 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.