registry / @pisell/pisellos / 2.3.167
@pisell/pisellos@2.3.167
一个可扩展的前端模块化SDK框架，支持插件系统
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection found a build-only prepublish hook and configurable logging whose default Feishu destination is an unusable placeholder. The scanner’s network, logging, and dynamic-code indicators do not establish an active attack in the inspected paths.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Application code configures and uses the ScanOrder logger.
Impact
No automatic disclosure to an unrelated recipient or other concrete attack effect was established.
Mechanism
The logger posts records to its configured provider; the default Feishu webhook is a placeholder that the provider rejects.
AI rationale
Source inspection found a build-only prepublish hook and configurable logging whose default Feishu destination is an unusable placeholder. The scanner’s network, logging, and dynamic-code indicators do not establish an active attack in the inspected paths.
Evidence
package.jsondist/plugins/request.jsdist/solution/ScanOrder/index.jslib/solution/RegisterAndLogin/utils.jsdist/plugins/window.jsdist/modules/ScanOrderLogger/index.jsdist/modules/ScanOrderLogger/providers/feishu.jsdist/modules/ScanOrderLogger/providers/grafana.js
Network endpoints2
open.feishu.cngrafana.example.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entrypoint is dist/index.js, and its only npm lifecycle hook is prepublishOnly running a build.
- The request plugin sends requests to the URL supplied in request configuration; no credential collection or unrelated recipient is shown in the inspected path.
- ScanOrder logs include its cache identifier and payload only when a logger is present; otherwise error logs go to the local console.
- The logger defaults to Feishu with a placeholder webhook, rejects placeholder webhooks, and takes logger configuration from application options.
- The flagged registration utilities format and mask email addresses; the window timer uses the platform timer when available and evaluates a supplied string handler only in its fallback.
Evidence against
- The logger supports POSTing application log records to configured Feishu or Grafana destinations, and the window timer has a fallback that evaluates string handlers.
Behavioral surface
EnvironmentVarsEvalNetwork
Source & flagged code
5 flagged · loading sourcedist/plugins/window.jsView file
•matchType = normalized_sha256
matchedPackage = @pisell/pisellos@0.10.70
matchedPath = dist/plugins/window.js
matchedIdentity = npm:QHBpc2VsbC9waXNlbGxvcw:0.10.70
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/plugins/window.jsView on unpkg248} else {
L249: eval(handler);
L250: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/plugins/window.jsView on unpkg · L248dist/solution/ScanOrder/index.jsView file
•Default hardcoded logging webhook in dist/solution/ScanOrder/index.js:
this.store.scanOrderLogger.setProviderConfig(((_this$otherParams5 = this.otherParams) === null || _this$otherParams5 === void 0 ? void 0 : _this$otherParams5.scanOrderLoggerConfig)...
webhook: 'https://open.feishu.cn/open-apis/bot/v2/hook/216b3fe6-af98-424e-8706-f0471241a7ed',
errorHook: 'https://open.feishu.cn/open-apis/bot/v2/hook/015b7c2a-dd3c-4c30-9898-ef0f5253111f'
Rich runtime records posted to the webhook in [redacted].js:
var context = record.context || {};
text: "\u65E5\u5FD7\u5185\u5BB9: ".concat(safeStringify(record.payload), "\n")
text: "\u6269\u5C55\u4FE1\u606F: ".concat(safeStringify(record.extra), "\n")
return fetch(webhook, {
Reachable runtime logger calls in dist/modules/Order/index.js:
this.logger.addL
Findings
1 Critical2 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/solution/ScanOrder/index.js
HighSemantic Analysis Limitedlib/solution/RegisterAndLogin/utils.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/plugins/window.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/plugins/window.js
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @pisell/pisellos@2.3.167.
See all versions of @pisell/pisellos for other recorded verdicts.
- Review the evidence and your use of @pisell/pisellos@2.3.167 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.