@pisell/pisellos@2.3.159
一个可扩展的前端模块化SDK框架，支持插件系统
AI Security Review
scanned 23d ago · by lpm-firewall-aiDefault external logging of customer identifiers creates a concrete data-exposure concern that warrants a warning. Its operational logging structure and configurable destination do not provide sufficient evidence for a malicious publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Initialize ScanOrder with its logger present and no replacement logger configuration, then perform logged operations such as customer login.
Impact
Customer identifiers and operational data can leave the consuming application for a recipient selected by the package defaults.
Mechanism
Operational methods create log payloads; the logger serializes their context and contents and sends HTTP POST requests to its webhook.
AI rationale
Default external logging of customer identifiers creates a concrete data-exposure concern that warrants a warning. Its operational logging structure and configurable destination do not provide sufficient evidence for a malicious publish block.
Evidence
dist/solution/ScanOrder/index.jsdist/modules/ScanOrderLogger/index.jsdist/modules/ScanOrderLogger/providers/feishu.js
Network endpoints1
open.feishu.cn
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- ScanOrder initialization falls back to package-supplied Feishu webhook configuration when no logger configuration is provided.
- Customer login automatically logs the customer identifier.
- ScanOrder forwards event payloads to the logger, which dispatches records to its configured provider.
- The Feishu provider serializes context and payloads and posts them to the webhook.
Evidence against
- Logging is integrated with order operations and supports caller configuration, which supports a legitimate telemetry purpose.
- No registry-install lifecycle hook, runtime self-dependency, shell execution, or filesystem harvesting was identified.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugins/window.jsView file
•matchType = normalized_sha256
matchedPackage = @pisell/pisellos@0.10.61
matchedPath = dist/plugins/window.js
matchedIdentity = npm:QHBpc2VsbC9waXNlbGxvcw:0.10.61
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/plugins/window.jsView on unpkg248} else {
L249: eval(handler);
L250: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/plugins/window.jsView on unpkg · L248dist/solution/ScanOrder/index.jsView file
•Default hardcoded logging webhook in dist/solution/ScanOrder/index.js:
this.store.scanOrderLogger.setProviderConfig(((_this$otherParams5 = this.otherParams) === null || _this$otherParams5 === void 0 ? void 0 : _this$otherParams5.scanOrderLoggerConfig)...
webhook: 'https://open.feishu.cn/open-apis/bot/v2/hook/216b3fe6-af98-424e-8706-f0471241a7ed',
errorHook: 'https://open.feishu.cn/open-apis/bot/v2/hook/015b7c2a-dd3c-4c30-9898-ef0f5253111f'
Rich runtime records posted to the webhook in [redacted].js:
var context = record.context || {};
text: "\u65E5\u5FD7\u5185\u5BB9: ".concat(safeStringify(record.payload), "\n")
text: "\u6269\u5C55\u4FE1\u606F: ".concat(safeStringify(record.extra), "\n")
return fetch(webhook, {
Reachable runtime logger calls in dist/modules/Order/index.js:
this.logger.addL
Findings
1 Critical2 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/solution/ScanOrder/index.js
HighSemantic Analysis Limitedlib/solution/RegisterAndLogin/utils.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/plugins/window.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/solution/ScanOrder/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/plugins/window.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @pisell/pisellos@2.3.159.
See all versions of @pisell/pisellos for other recorded verdicts.
- Review the evidence and your use of @pisell/pisellos@2.3.159 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.