registry / @yimou6/common-ui / 1.13.26

@yimou6/common-ui@1.13.26

Vue3 Component Library

AI Security Review

scanned 23d ago · by lpm-firewall-ai

The required source paths show package-aligned mapping and date behavior, with no concrete malicious chain. The inspected manifest and entrypoints provide no install-hook attack evidence.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Using the map component initializes the mapping service; no npm install lifecycle trigger is declared.

Impact

Expected mapping functionality; no confirmed credential harvesting, malicious execution, or control-surface mutation was established.

Mechanism

The component loads a fixed mapping SDK and sends map searches and coordinates to that service. Inspected installation helpers register Vue components.

AI rationale

The required source paths show package-aligned mapping and date behavior, with no concrete malicious chain. The inspected manifest and entrypoints provide no install-hook attack evidence.

Network endpoints1

api.tianditu.gov.cn

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes Vue library entrypoints and contains no lifecycle hooks or runtime self-dependency.
The map component loads the Tianditu SDK from its fixed service endpoint for map functionality.
The bundled Day.js implementation performs ordinary date conversion and serialization.
The Vue install helper registers components with the application.

Evidence against

Behavioral surface

Source

CryptoEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 332 file(s), 3.15 MB of source, external domains: api.tianditu.gov.cn, npms.io, www.w3.org

Source & flagged code

7 flagged

lib/components/map/src/map.vue2.jsView file

Lines 26-66javascript

26 ...{

27 name: "IMap"

28 },

29 __name: "map",

30 props: map.MapProps,

31 emits: [

32 "update:modelValue",

33 "change",

34 "update:addressCode",

35 "update:address"

36 ],

37 setup(__props, { expose: __expose, emit: __emit }) {

38 const props = __props;

39 const emits = __emit;

40 const { modelValue, disabled, options } = vue.toRefs(props);

41 const _win = window;

42 function loadTiandituScript() {

43 if (_win.__tdt_loaded) return Promise.resolve();

44 if (_win.__tdt_loading) return _win.__tdt_loading;

45 _win.__tdt_loading = new Promise((resolve, reject) => {

46 const script = document.createElement("script");

47 script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

48 script.onload = () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Low

Ai Review Evidence

The map component loads the Tianditu SDK from its fixed service endpoint for map functionality.

lib/components/map/src/map.vue2.jsView on unpkg · L46

49 _win.__tdt_loaded = true;

50 _win.__tdt_loading = null;

51 resolve();

52 };

53 script.onerror = () => {

54 _win.__tdt_loading = null;

55 reject(new Error("\u5929\u5730\u56FE API \u52A0\u8F7D\u5931\u8D25"));

56 };

57 document.head.appendChild(script);

58 });

59 return _win.__tdt_loading;

60 }

61 __name(loadTiandituScript, "loadTiandituScript");

62 function getT() {

63 return _win.T;

64 }

65 __name(getT, "getT");

66 async function tdtSearch(keyword2) {

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 39-79json

39 "./es/*": {

40 "types": [

41 "./es/*.d.ts",

42 "./es/*/index.d.ts"

43 ],

44 "import": "./es/*.mjs"

45 },

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.jsView file

Lines 1-21javascript

1'use strict';

3require('../../../../../_virtual/_commonjsHelpers.js');

4var dayjs_min$1 = require('../../../../../_virtual/dayjs.min2.js');

6var dayjs_min = dayjs_min$1.__module.exports;

lib/utils/install.jsView file

Lines 1-24javascript

1'use strict';

3var __defProp = Object.defineProperty;

4var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

Source & flagged code

7 flagged · loading source

lib/components/map/src/map.vue2.jsView file

46const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46Trigger-reachable chain: manifest.main -> lib/index.js -> lib/components/map/index.js -> lib/components/map/src/map.vue2.js L46: const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46const script = document.createElement("script"); script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

Findings

2 Critical1 High2 Medium7 Low

CriticalHardcoded Runtime Data Exfiltrationlib/components/map/src/map.vue2.js

CriticalTrigger Reachable Dangerous Capabilitylib/components/map/src/map.vue2.js

HighSemantic Analysis Limitedlib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencelib/components/map/src/map.vue2.js

LowAi Review Evidencelib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js

LowAi Review Evidencelib/utils/install.js

Affected versions and remediation

This report applies to @yimou6/common-ui@1.13.26.

See all versions of @yimou6/common-ui for other recorded verdicts.

Review the evidence and your use of @yimou6/common-ui@1.13.26 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 14:20:58.899Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.