registry / @yimou6/common-ui / 1.14.4

@yimou6/common-ui@1.14.4

Vue3 Component Library

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Source inspection shows the flagged network behavior is part of an exported map picker and targets Tianditu’s map services. No malicious data collection or transfer was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Using the map picker, entering a place query, or clicking a map location.

Impact

The requests provide map search and address display; the inspected flow does not expose credentials or unrelated application records.

Mechanism

The component loads Tianditu’s map API, sends place queries to its search endpoint, and sends clicked coordinates for reverse geocoding.

AI rationale

Source inspection shows the flagged network behavior is part of an exported map picker and targets Tianditu’s map services. No malicious data collection or transfer was established.

Evidence

lib/components/map/src/map.vue2.js

Network endpoints1

api.tianditu.gov.cn

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json sets lib/index.js as the CommonJS main entry and es/index.mjs as the module entry.
lib/index.js loads the map component as part of the UI library.
The map component contacts Tianditu’s map API, sends entered place queries to its search endpoint, and reverse-geocodes coordinates after map clicks. The inspected flow shows ordinary map-picker behavior and no credential or unrelated-record transfer.

Evidence against

The flagged external requests are for map loading, place search, and reverse geocoding; the inspected component does not collect credentials or send unrelated application records.

Behavioral surface

Source

CryptoEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 326 file(s), 2.99 MB of source, external domains: api.tianditu.gov.cn, npms.io, www.w3.org

Source & flagged code

7 flagged

lib/components/map/src/map.vue2.jsView file

Lines 26-121javascript

26 ...{

27 name: "IMap"

28 },

29 __name: "map",

30 props: map.MapProps,

31 emits: [

32 "update:modelValue",

33 "change",

34 "update:addressCode",

35 "update:address"

36 ],

37 setup(__props, { expose: __expose, emit: __emit }) {

38 const props = __props;

39 const emits = __emit;

40 const { modelValue, disabled, options } = vue.toRefs(props);

41 const _win = window;

42 function loadTiandituScript() {

43 if (_win.__tdt_loaded) return Promise.resolve();

44 if (_win.__tdt_loading) return _win.__tdt_loading;

45 _win.__tdt_loading = new Promise((resolve, reject) => {

46 const script = document.createElement("script");

47 script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

48 script.onload = () => {

49 _win.__tdt_loaded = true;

50 _win.__tdt_loading = null;

Low

Ai Review Evidence

The map component contacts Tianditu’s map API, sends entered place queries to its search endpoint, and reverse-geocodes coordinates after map clicks. The inspected flow shows ordinary map-picker behavior and no credential or unrelated-record transfer.

lib/components/map/src/map.vue2.jsView on unpkg · L47

51 resolve();

52 };

53 script.onerror = () => {

54 _win.__tdt_loading = null;

55 reject(new Error("\u5929\u5730\u56FE API \u52A0\u8F7D\u5931\u8D25"));

56 };

57 document.head.appendChild(script);

58 });

59 return _win.__tdt_loading;

60 }

61 __name(loadTiandituScript, "loadTiandituScript");

62 function getT() {

63 return _win.T;

64 }

65 __name(getT, "getT");

66 async function tdtSearch(keyword2) {

67 const postStr = JSON.stringify({

68 keyWord: keyword2,

69 level: 12,

70 mapBound: "73.66,3.86,135.05,53.55",

71 queryType: 7,

72 start: 0,

73 count: 20

74 });

75 const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postStr)}&type=query&tk=${TIANDITU_TOKEN}`;

76 try {

77 const resp = await fetch(url);

78 if (!resp.ok) return [];

Low

Ai Review Evidence

lib/components/map/src/map.vue2.jsView on unpkg · L75

79 const data = await resp.json();

80 if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

81 return data.pois.map((poi) => ({

82 value: poi.name,

83 name: poi.name,

84 district: poi.address || "",

85 location: poi.lonlat ? {

86 lng: Number(poi.lonlat.split(" ")[0]),

87 lat: Number(poi.lonlat.split(" ")[1])

88 } : null,

89 adcode: poi.admincode || "",

90 _raw: poi

91 }));

92 }

93 return [];

94 } catch {

95 return [];

96 }

97 }

98 __name(tdtSearch, "tdtSearch");

99 async function tdtReverseGeocode(lng, lat) {

100 const postStr = JSON.stringify({ lon: lng, lat, ver: 1 });

101 const url = `https://api.tianditu.gov.cn/geocoder?postStr=${encodeURIComponent(postStr)}&type=geocode&tk=${TIANDITU_TOKEN}`;

102 const resp = await fetch(url);

103 const data = await resp.json();

Low

Ai Review Evidence

lib/components/map/src/map.vue2.jsView on unpkg · L101

104 if (data && data.result) {

105 return data.result.formatted_address || data.result.address || "";

106 }

107 return "";

108 }

109 __name(tdtReverseGeocode, "tdtReverseGeocode");

110 let map = null;

111 let marker$1 = null;

112 let infoWindow = null;

113 const dialogVisible = vue.ref(false);

114 const keyword = vue.ref("");

115 const model = vue.ref([]);

116 const refMap = vue.ref(null);

117 const center = vue.ref([116.397428, 39.90923]);

118 const zoom = vue.ref(10);

119 function clearMarker() {

120 if (marker$1) {

121 map == null ? void 0 : map.removeOverLay(marker$1);

package.jsonView file

Lines 39-79json

39 "./es/*": {

40 "types": [

41 "./es/*.d.ts",

42 "./es/*/index.d.ts"

43 ],

44 "import": "./es/*.mjs"

45 },

lib/index.jsView file

Lines 1-41javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5var installer = require('./installer.js');

6require('./components/index.js'

Source & flagged code

7 flagged · loading source

lib/components/map/src/map.vue2.jsView file

46const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46Trigger-reachable chain: manifest.main -> lib/index.js -> lib/components/map/index.js -> lib/components/map/src/map.vue2.js L46: const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

47script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; script.onload = () => { _win.__tdt_loaded = true; _win.__tdt_loading = null;

Findings

2 Critical2 Medium8 Low

CriticalHardcoded Runtime Data Exfiltrationlib/components/map/src/map.vue2.js

CriticalTrigger Reachable Dangerous Capabilitylib/components/map/src/map.vue2.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencelib/index.js

LowAi Review Evidencelib/components/map/src/map.vue2.js

Affected versions and remediation

This report applies to @yimou6/common-ui@1.14.4.

See all versions of @yimou6/common-ui for other recorded verdicts.

Review the evidence and your use of @yimou6/common-ui@1.14.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 02:46:10.255Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.