registry / @yimou6/common-ui / 1.13.23

@yimou6/common-ui@1.13.23

⚠ Under review

Vue3 Component Library

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 332 file(s), 3.15 MB of source, external domains: api.tianditu.gov.cn, npms.io, www.w3.org

Source & flagged code

3 flagged

lib/components/map/src/map.vue2.jsView file

Lines 26-66javascript

26 ...{

27 name: "IMap"

28 },

29 __name: "map",

30 props: map.MapProps,

31 emits: [

32 "update:modelValue",

33 "change",

34 "update:addressCode",

35 "update:address"

36 ],

37 setup(__props, { expose: __expose, emit: __emit }) {

38 const props = __props;

39 const emits = __emit;

40 const { modelValue, disabled, options } = vue.toRefs(props);

41 const _win = window;

42 function loadTiandituScript() {

43 if (_win.__tdt_loaded) return Promise.resolve();

44 if (_win.__tdt_loading) return _win.__tdt_loading;

45 _win.__tdt_loading = new Promise((resolve, reject) => {

46 const script = document.createElement("script");

47 script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

48 script.onload = () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

49 _win.__tdt_loaded = true;

50 _win.__tdt_loading = null;

51 resolve();

52 };

53 script.onerror = () => {

54 _win.__tdt_loading = null;

55 reject(new Error("\u5929\u5730\u56FE API \u52A0\u8F7D\u5931\u8D25"));

56 };

57 document.head.appendChild(script);

58 });

59 return _win.__tdt_loading;

60 }

61 __name(loadTiandituScript, "loadTiandituScript");

62 function getT() {

63 return _win.T;

64 }

65 __name(getT, "getT");

66 async function tdtSearch(keyword2) {

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1View on unpkg

Source & flagged code

3 flagged · loading source

lib/components/map/src/map.vue2.jsView file

46const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46Trigger-reachable chain: manifest.main -> lib/index.js -> lib/components/map/index.js -> lib/components/map/src/map.vue2.js L46: const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1

Findings

2 Critical1 High2 Medium3 Low

CriticalHardcoded Runtime Data Exfiltrationlib/components/map/src/map.vue2.js

CriticalTrigger Reachable Dangerous Capabilitylib/components/map/src/map.vue2.js

HighSemantic Analysis Limitedlib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @yimou6/common-ui@1.13.23.

See all versions of @yimou6/common-ui for other recorded verdicts.

Review the evidence and your use of @yimou6/common-ui@1.13.23 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 20:33:58.601Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.