registry / @yimou6/common-ui / 1.14.3

@yimou6/common-ui@1.14.3

Vue3 Component Library

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The flagged network behavior is consistent with the exported map component’s rendering, search, and geocoding functions. The inspected source provides no evidence of credential harvesting or unrelated data exfiltration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Map requests occur when the map view is rendered, its dialog is opened, or a search is entered.

Impact

These requests support the map interface; inspected source shows no credential transfer to an unrelated recipient.

Mechanism

The component sends search keywords and selected coordinates to Tianditu map APIs.

AI rationale

Evidence

lib/components/map/src/map.vue2.js

Network endpoints1

api.tianditu.gov.cn

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to library entrypoints; the map component is included in the exported component library.
The map search sends the entered keyword to Tianditu’s search API.
Reverse geocoding sends map coordinates to Tianditu’s geocoder.
Map initialization is activated by rendering the view component or opening its dialog.

Evidence against

Behavioral surface

Source

CryptoEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 326 file(s), 2.99 MB of source, external domains: api.tianditu.gov.cn, npms.io, www.w3.org

Source & flagged code

7 flagged

lib/components/map/src/map.vue2.jsView file

Lines 26-95javascript

26 ...{

27 name: "IMap"

28 },

29 __name: "map",

30 props: map.MapProps,

31 emits: [

32 "update:modelValue",

33 "change",

34 "update:addressCode",

35 "update:address"

36 ],

37 setup(__props, { expose: __expose, emit: __emit }) {

38 const props = __props;

39 const emits = __emit;

40 const { modelValue, disabled, options } = vue.toRefs(props);

41 const _win = window;

42 function loadTiandituScript() {

43 if (_win.__tdt_loaded) return Promise.resolve();

44 if (_win.__tdt_loading) return _win.__tdt_loading;

45 _win.__tdt_loading = new Promise((resolve, reject) => {

46 const script = document.createElement("script");

47 script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

48 script.onload = () => {

49 _win.__tdt_loaded = true;

50 _win.__tdt_loading = null;

51 resolve();

52 };

53 script.onerror = () => {

54 _win.__tdt_loading = null;

55 reject(new Error("\u5929\u5730\u56FE API \u52A0\u8F7D\u5931\u8D25"));

56 };

57 document.head.appendChild(script);

58 });

59 return _win.__tdt_loading;

60 }

61 __name(loadTiandituScript, "loadTiandituScript");

62 function getT() {

63 return _win.T;

64 }

65 __name(getT, "getT");

66 async function tdtSearch(keyword2) {

67 const postStr = JSON.stringify({

68 keyWord: keyword2,

69 level: 12,

70 mapBound: "73.66,3.86,135.05,53.55",

71 queryType: 7,

72 start: 0,

73 count: 20

Low

Ai Review Evidence

The map search sends the entered keyword to Tianditu’s search API.

lib/components/map/src/map.vue2.jsView on unpkg · L67

74 });

75 const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postStr)}&type=query&tk=${TIANDITU_TOKEN}`;

76 try {

77 const resp = await fetch(url);

Low

Ai Review Evidence

The map search sends the entered keyword to Tianditu’s search API.

lib/components/map/src/map.vue2.jsView on unpkg · L75

78 if (!resp.ok) return [];

79 const data = await resp.json();

80 if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

81 return data.pois.map((poi) => ({

82 value: poi.name,

83 name: poi.name,

84 district: poi.address || "",

85 location: poi.lonlat ? {

86 lng: Number(poi.lonlat.split(" ")[0]),

87 lat: Number(poi.lonlat.split(" ")[1])

88 } : null,

89 adcode: poi.admincode || "",

90 _raw: poi

91 }));

92 }

93 return [];

94 } catch {

95 return [];

package.jsonView file

Lines 39-79json

39 "./es/*": {

40 "types": [

41 "./es/*.d.ts",

42 "./es/*/index.d.ts"

43 ],

44 "import": "./es/*.mjs"

45 },

lib/components/map/index.jsView file

Lines 1-14javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5var install = require('../../utils/install.js');

6require(

lib/components/index.jsView file

Lines 1-34javascript

1'use strict';

3var index = require('./checkbox/index.js');

4var index$1 = require('./date-picker/index.js');

5var index$2 = require

Source & flagged code

7 flagged · loading source

lib/components/map/src/map.vue2.jsView file

46const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46Trigger-reachable chain: manifest.main -> lib/index.js -> lib/components/map/index.js -> lib/components/map/src/map.vue2.js L46: const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

67const postStr = JSON.stringify({ keyWord: keyword2, level: 12, mapBound: "73.66,3.86,135.05,53.55", queryType: 7, start: 0, co

Findings

2 Critical2 Medium8 Low

CriticalHardcoded Runtime Data Exfiltrationlib/components/map/src/map.vue2.js

CriticalTrigger Reachable Dangerous Capabilitylib/components/map/src/map.vue2.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencelib/components/map/index.js

LowAi Review Evidencelib/components/index.js

LowAi Review Evidencelib/components/map/src/map.vue2.js

Affected versions and remediation

This report applies to @yimou6/common-ui@1.14.3.

See all versions of @yimou6/common-ui for other recorded verdicts.

Review the evidence and your use of @yimou6/common-ui@1.14.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 02:37:31.730Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.