registry / @yimou6/common-ui / 1.14.0

@yimou6/common-ui@1.14.0

Vue3 Component Library

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Source inspection shows the flagged requests belong to the exported map component and send map search terms or coordinates to its map provider. This is consistent with the component’s function, and no concrete attack behavior was identified.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Rendering the map in view mode loads the provider API; opening the map dialog or using search and map selection activates related requests.

Impact

Map search terms and selected coordinates are disclosed to the map provider as part of the component’s function; no unrelated credential or application record transfer was found.

Mechanism

The component sends search keywords or selected coordinates to Tianditu and uses the responses to display map results and addresses.

AI rationale

Evidence

package.jsonlib/index.jslib/components/map/src/map.vue2.js

Network endpoints1

api.tianditu.gov.cn

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package entrypoints expose the component library, which includes the map component.
The map sends search keywords to the Tianditu search API.
The map loads the provider API when a view is rendered or its dialog is opened.
Reverse geocoding sends selected map coordinates to the same provider.
The network behavior matches the map component’s stated function; no unrelated credential or record transfer was identified.

Evidence against

Behavioral surface

Source

CryptoEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 326 file(s), 3.04 MB of source, external domains: api.tianditu.gov.cn, npms.io, www.w3.org

Source & flagged code

7 flagged

lib/components/map/src/map.vue2.jsView file

Lines 26-95javascript

26 ...{

27 name: "IMap"

28 },

29 __name: "map",

30 props: map.MapProps,

31 emits: [

32 "update:modelValue",

33 "change",

34 "update:addressCode",

35 "update:address"

36 ],

37 setup(__props, { expose: __expose, emit: __emit }) {

38 const props = __props;

39 const emits = __emit;

40 const { modelValue, disabled, options } = vue.toRefs(props);

41 const _win = window;

42 function loadTiandituScript() {

43 if (_win.__tdt_loaded) return Promise.resolve();

44 if (_win.__tdt_loading) return _win.__tdt_loading;

45 _win.__tdt_loading = new Promise((resolve, reject) => {

46 const script = document.createElement("script");

47 script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

48 script.onload = () => {

49 _win.__tdt_loaded = true;

50 _win.__tdt_loading = null;

51 resolve();

52 };

53 script.onerror = () => {

54 _win.__tdt_loading = null;

55 reject(new Error("\u5929\u5730\u56FE API \u52A0\u8F7D\u5931\u8D25"));

56 };

57 document.head.appendChild(script);

58 });

59 return _win.__tdt_loading;

60 }

61 __name(loadTiandituScript, "loadTiandituScript");

62 function getT() {

63 return _win.T;

64 }

65 __name(getT, "getT");

66 async function tdtSearch(keyword2) {

67 const postStr = JSON.stringify({

68 keyWord: keyword2,

69 level: 12,

70 mapBound: "73.66,3.86,135.05,53.55",

71 queryType: 7,

72 start: 0,

73 count: 20

74 });

75 const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postStr)}&type=query&tk=${TIANDITU_TOKEN}`;

76 try {

77 const resp = await fetch(url);

78 if (!resp.ok) return [];

Low

Ai Review Evidence

The map sends search keywords to the Tianditu search API.

lib/components/map/src/map.vue2.jsView on unpkg · L75

79 const data = await resp.json();

80 if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

81 return data.pois.map((poi) => ({

82 value: poi.name,

83 name: poi.name,

84 district: poi.address || "",

85 location: poi.lonlat ? {

86 lng: Number(poi.lonlat.split(" ")[0]),

87 lat: Number(poi.lonlat.split(" ")[1])

88 } : null,

89 adcode: poi.admincode || "",

90 _raw: poi

91 }));

92 }

93 return [];

94 } catch {

95 return [];

Lines 135-175javascript

135 marker$1 = new T.Marker(new T.LngLat(lnglat[0], lnglat[1]), { icon });

136 map.addOverLay(marker$1);

137 if (name) {

138 keyword.value = name;

Lines 187-227javascript

187 }

188 __name(initMap, "initMap");

189 function destroyMap() {

190 clearMarker();

191 if (infoWindow) {

192 try {

193 infoWindow.closeInfoWindow();

Lines 284-324javascript

284 dialogVisible.value = false;

285 setTimeout(() => destroyMap(), 300);

286 }, "handleConfirm");

287 const clearValue = /* @__PURE__ */ __name(()

package.jsonView file

Lines 39-79json

39 "./es/*": {

40 "types": [

41 "./es/*.d.ts",

42 "./es/*/index.d.ts"

43 ],

44 "import": "./es/*.mjs"

45 },

Source & flagged code

7 flagged · loading source

lib/components/map/src/map.vue2.jsView file

46const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46Trigger-reachable chain: manifest.main -> lib/index.js -> lib/components/map/index.js -> lib/components/map/src/map.vue2.js L46: const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

75const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postStr)}&type=query&tk=${TIANDITU_TOKEN}`; try { const resp = await fetch(url); if (!r

Findings

2 Critical2 Medium8 Low

CriticalHardcoded Runtime Data Exfiltrationlib/components/map/src/map.vue2.js

CriticalTrigger Reachable Dangerous Capabilitylib/components/map/src/map.vue2.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencelib/components/map/src/map.vue2.js

Affected versions and remediation

This report applies to @yimou6/common-ui@1.14.0.

See all versions of @yimou6/common-ui for other recorded verdicts.

Review the evidence and your use of @yimou6/common-ui@1.14.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 09:59:05.409Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.