registry / @yimou6/common-ui / 1.13.28

@yimou6/common-ui@1.13.28

Vue3 Component Library

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The flagged network calls are tied to the map component’s location search and geocoding behavior and use the mapping service endpoint. The inspected entrypoint and flagged dependency source revealed no concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Map search, map display, or a map click activates the relevant requests.

Impact

Tianditu receives map search terms or coordinates; inspected source shows no credential transfer or unrelated recipient.

Mechanism

The component sends the search keyword or selected coordinates to Tianditu’s mapping API and uses the response to display locations or addresses.

AI rationale

Evidence

lib/components/map/src/map.vue2.js

Network endpoints1

api.tianditu.gov.cn

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points consumers to ordinary library entrypoints; the CommonJS entrypoint imports the map component.
Map search sends the entered keyword to Tianditu’s search API, and the autocomplete connects that request to its search input.
Reverse geocoding sends clicked map coordinates to the same mapping service.
The flagged dayjs bundle contains date parsing and formatting logic.

Evidence against

The inspected map code sends map search terms and coordinates to its mapping provider; it shows no credential harvesting or unrelated receiver.
The scanner’s flagged network behavior matches the map component’s location search and geocoding functions.

Behavioral surface

Source

CryptoEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

lib/components/map/src/map.vue2.jsView file

Lines 26-86javascript

26 ...{

27 name: "IMap"

28 },

29 __name: "map",

30 props: map.MapProps,

31 emits: [

32 "update:modelValue",

33 "change",

34 "update:addressCode",

35 "update:address"

36 ],

37 setup(__props, { expose: __expose, emit: __emit }) {

38 const props = __props;

39 const emits = __emit;

40 const { modelValue, disabled, options } = vue.toRefs(props);

41 const _win = window;

42 function loadTiandituScript() {

43 if (_win.__tdt_loaded) return Promise.resolve();

44 if (_win.__tdt_loading) return _win.__tdt_loading;

45 _win.__tdt_loading = new Promise((resolve, reject) => {

46 const script = document.createElement("script");

47 script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

48 script.onload = () => {

49 _win.__tdt_loaded = true;

50 _win.__tdt_loading = null;

51 resolve();

52 };

53 script.onerror = () => {

54 _win.__tdt_loading = null;

55 reject(new Error("\u5929\u5730\u56FE API \u52A0\u8F7D\u5931\u8D25"));

56 };

57 document.head.appendChild(script);

58 });

59 return _win.__tdt_loading;

60 }

61 __name(loadTiandituScript, "loadTiandituScript");

62 function getT() {

63 return _win.T;

64 }

65 __name(getT, "getT");

66 async function tdtSearch(keyword2) {

67 const postStr = JSON.stringify({

68 keyWord: keyword2,

69 level: 12,

70 mapBound: "73.66,3.86,135.05,53.55",

71 queryType: 7,

72 start: 0,

73 count: 20

74 });

75 const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postStr)}&type=query&tk=${TIANDITU_TOKEN}`;

Low

Ai Review Evidence

Map search sends the entered keyword to Tianditu’s search API, and the autocomplete connects that request to its search input.

lib/components/map/src/map.vue2.jsView on unpkg · L66

76 try {

77 const resp = await fetch(url);

78 if (!resp.ok) return [];

79 const data = await resp.json();

80 if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

81 return data.pois.map((poi) => ({

82 value: poi.name,

83 name: poi.name,

84 district: poi.address || "",

85 location: poi.lonlat ? {

86 lng: Number(poi.lonlat.split(" ")[0]),

Lines 195-235javascript

195 }

196 infoWindow = null;

197 }

198 if (map) {

199 try {

200 map.destroy();

201 } catch {

202 }

203

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 39-79json

39 "./es/*": {

40 "types": [

41 "./es/*.d.ts",

42 "./es/*/index.d.ts"

43 ],

44 "import": "./es/*.mjs"

45 },

lib/index.jsView file

Lines 1-40javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5var installer = require('./installer.js');

6require('./components/index.js'

Source & flagged code

7 flagged · loading source

lib/components/map/src/map.vue2.jsView file

46const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46Trigger-reachable chain: manifest.main -> lib/index.js -> lib/components/map/index.js -> lib/components/map/src/map.vue2.js L46: const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

66async function tdtSearch(keyword2) { const postStr = JSON.stringify({ keyWord: keyword2, level: 12, mapBound: "73.66,3.86,135.05,53.55", queryType: 7, start: 0, count: 20 }); const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postS

Findings

2 Critical1 High2 Medium7 Low

CriticalHardcoded Runtime Data Exfiltrationlib/components/map/src/map.vue2.js

CriticalTrigger Reachable Dangerous Capabilitylib/components/map/src/map.vue2.js

HighSemantic Analysis Limitedlib/node_modules/.pnpm/dayjs@1.11.13/node_modules/dayjs/dayjs.min.js#virtual:string-array:round1

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencelib/index.js

LowAi Review Evidencelib/components/map/src/map.vue2.js

Affected versions and remediation

This report applies to @yimou6/common-ui@1.13.28.

See all versions of @yimou6/common-ui for other recorded verdicts.

Review the evidence and your use of @yimou6/common-ui@1.13.28 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 15:06:56.626Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.