registry / @yimou6/common-ui / 1.14.6

@yimou6/common-ui@1.14.6

Vue3 Component Library

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The scanner’s flagged network behavior is present, but source inspection shows it implements the exported map component and sends map queries or coordinates to its mapping provider. The manifest has no install lifecycle hook, and the inspected component shows no unrelated data collection or attack behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Autocomplete sends a search term when used; map initialization or marker placement can send coordinates for reverse geocoding.

Impact

The inspected requests disclose map search terms or coordinates to the mapping service for the component’s stated map functions; no unrelated collection or attack behavior was established.

Mechanism

The component loads Tianditu’s map SDK, requests place results using the entered term, and requests an address using map coordinates.

AI rationale

Evidence

package.jsonlib/index.jslib/components/map/index.jslib/components/map/src/map.vue2.js

Network endpoints1

api.tianditu.gov.cn

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points consumers to the library entrypoints and declares Vue and UI component dependencies; it contains no lifecycle hook.
The library exports IMap through the map component wrapper.
The map autocomplete sends the entered search term to Tianditu and uses the returned places as map results.
Reverse geocoding sends map coordinates to Tianditu and uses the response as an address.
The component loads Tianditu’s map SDK; editing opens from the map input, while read-only maps initialize on mount.

Evidence against

Behavioral surface

Source

CryptoEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 322 file(s), 2.99 MB of source, external domains: api.tianditu.gov.cn, npms.io, www.w3.org

Source & flagged code

7 flagged

lib/components/map/src/map.vue2.jsView file

Lines 26-88javascript

26 ...{

27 name: "IMap"

28 },

29 __name: "map",

30 props: map.MapProps,

31 emits: [

32 "update:modelValue",

33 "change",

34 "update:addressCode",

35 "update:address"

36 ],

37 setup(__props, { expose: __expose, emit: __emit }) {

38 const props = __props;

39 const emits = __emit;

40 const { modelValue, disabled, options } = vue.toRefs(props);

41 const _win = window;

42 function loadTiandituScript() {

43 if (_win.__tdt_loaded) return Promise.resolve();

44 if (_win.__tdt_loading) return _win.__tdt_loading;

45 _win.__tdt_loading = new Promise((resolve, reject) => {

46 const script = document.createElement("script");

47 script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`;

48 script.onload = () => {

49 _win.__tdt_loaded = true;

50 _win.__tdt_loading = null;

51 resolve();

52 };

53 script.onerror = () => {

54 _win.__tdt_loading = null;

55 reject(new Error("\u5929\u5730\u56FE API \u52A0\u8F7D\u5931\u8D25"));

56 };

57 document.head.appendChild(script);

58 });

59 return _win.__tdt_loading;

60 }

61 __name(loadTiandituScript, "loadTiandituScript");

62 function getT() {

63 return _win.T;

64 }

65 __name(getT, "getT");

66 async function tdtSearch(keyword2) {

67 const postStr = JSON.stringify({

68 keyWord: keyword2,

69 level: 12,

70 mapBound: "73.66,3.86,135.05,53.55",

71 queryType: 7,

72 start: 0,

73 count: 20

74 });

75 const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postStr)}&type=query&tk=${TIANDITU_TOKEN}`;

76 try {

Low

Ai Review Evidence

The map autocomplete sends the entered search term to Tianditu and uses the returned places as map results.

lib/components/map/src/map.vue2.jsView on unpkg · L68

77 const resp = await fetch(url);

78 if (!resp.ok) return [];

79 const data = await resp.json();

80 if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

81 return data.pois.map((poi) => ({

82 value: poi.name,

83 name: poi.name,

84 district: poi.address || "",

85 location: poi.lonlat ? {

86 lng: Number(poi.lonlat.split(" ")[0]),

87 lat: Number(poi.lonlat.split(" ")[1])

88 } : null,

package.jsonView file

Lines 39-101json

39 "./es/*": {

40 "types": [

41 "./es/*.d.ts",

42 "./es/*/index.d.ts"

43 ],

44 "import": "./es/*.mjs"

45 },

lib/index.jsView file

Lines 1-40javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5var installer = require('./installer.js');

6require('./components/index.js'

lib/components/map/index.jsView file

Lines 1-14javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5var install = require('../../utils/install.js');

6require(

Source & flagged code

7 flagged · loading source

lib/components/map/src/map.vue2.jsView file

46const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/components/map/src/map.vue2.jsView on unpkg · L46

46Trigger-reachable chain: manifest.main -> lib/index.js -> lib/components/map/index.js -> lib/components/map/src/map.vue2.js L46: const script = document.createElement("script"); L47: script.src = `https://api.tianditu.gov.cn/api?v=4.0&tk=${TIANDITU_TOKEN}`; L48: script.onload = () => { ... L78: if (!resp.ok) return []; L79: const data = await resp.json(); L80: if (data && data.pois) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/components/map/src/map.vue2.jsView on unpkg · L46

68keyWord: keyword2, level: 12, mapBound: "73.66,3.86,135.05,53.55", queryType: 7, start: 0, count: 20 }); const url = `https://api.tianditu.gov.cn/v2/search?postStr=${encodeURIComponent(postStr)}&type=query&tk=${TIANDITU_TOKEN}`; try {

Findings

2 Critical2 Medium8 Low

CriticalHardcoded Runtime Data Exfiltrationlib/components/map/src/map.vue2.js

CriticalTrigger Reachable Dangerous Capabilitylib/components/map/src/map.vue2.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencelib/index.js

LowAi Review Evidencelib/components/map/index.js

LowAi Review Evidencelib/components/map/src/map.vue2.js

Affected versions and remediation

This report applies to @yimou6/common-ui@1.14.6.

See all versions of @yimou6/common-ui for other recorded verdicts.

Review the evidence and your use of @yimou6/common-ui@1.14.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 09:17:03.331Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.