registry / cloud-web-corejs / 1.0.249

cloud-web-corejs@1.0.249

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface was found. The main risk is an obfuscated, user-invoked Excel import component that talks to the host app's configured backend.

Static reason

One or more suspicious static signals were detected.

Trigger

User opens/uses Vue UI components such as excelImport or print/upload widgets

Impact

No confirmed credential harvesting, persistence, destructive action, or exfiltration beyond intended app requests

Mechanism

frontend business UI network calls and local dynamic component loading

Rationale

Static inspection found suspicious obfuscation in a frontend Excel import mixin, but its observed behavior is package-aligned and user-invoked, with no lifecycle hook, persistence, filesystem mutation, foreign agent control-surface writes, or confirmed exfiltration. The static hints appear noisy for this package.

Evidence

package.jsonsrc/components/excelImport/mixins.jssrc/mixins/mobile/wf/index.jssrc/components/xform/utils/sfc-generator.jssrc/components/hiprint/hiprint.bundle.jssrc/components/hiprint/fonts/glyphicons-halflings-regular.woff

Network endpoints7

registry.npmjs.org/localhost:17521meta.pinduoduo.com/api/one/app/v1/lateststable?appId=com.xunmeng.pddprint&platform=windows&subType=mainfile-link.pinduoduo.com/sf_oneobs.cn-south-1.myhuaweicloud.comjsonplaceholder.typicode.com/posts/crm-dev.hisense.com

Decision evidence

public snapshot

AI called this Clean at 78.0% confidence as Benign with low false-positive risk.

Evidence for block

src/components/excelImport/mixins.js is deliberately obfuscated and performs runtime Excel import/download actions
src/components/xform/form-designer/form-widget/field-widget/vabUpload2-widget.vue contains commented example tokens/URLs

Evidence against

package.json has no preinstall/install/postinstall/prepare hooks and no bin/main entrypoint
No child_process/fs persistence/AI-agent control-surface writes found by source grep
src/components/excelImport/mixins.js uses package-aligned Vue/XLSX import flows, getToken, $http, and configured VUE_APP_BASE_API/USER_PREFIX endpoints
src/mixins/mobile/wf/index.js dynamic require loads local workflow Vue components only
src/components/hiprint/fonts/glyphicons-halflings-regular.woff is a normal WOFF font
Network URLs are UI/printing/upload examples or product service endpoints, not confirmed exfiltration

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 258 file(s), 3.73 MB of source, external domains: cainiao-oss-sh-read.oss-cn-shanghai.aliyuncs.com, cdn.bootcss.com, cdn.staticfile.org, cloudprint.cainiao.com, file-link.pinduoduo.com, github.com, hiprint.io, ks3-cn-beijing.ksyun.com, ks3-cn-beijing.ksyuncs.com, lf26-cdn-tos.bytecdntp.com, map.baidu.com, meta.pinduoduo.com, obs.cn-south-1.myhuaweicloud.com, portrait.gitee.com, prod-oms-app-cprt.jdwl.com, vos.vipstatic.com, www.vform666.com, www.w3.org, xhswaybill-printer-1251524319.cos.ap-shanghai.myqcloud.com

Source & flagged code

5 flagged

src/components/xform/utils/sfc-generator.jsView file

Lines 105-145javascript

105 },

106

107 'sub-form': (ctn, formConfig) => {

108 //TODO:

109 },

110

111}

112

113export function buildContainerWidget(widget, formConfig) {

114 return containerTemplates[widget.type] ? containerTemplates[widget.type](widget, formConfig) : null

115}

116

117function getElAttrs(widget, formConfig) { //获取El组件属性

118 let wop = widget.options

119 return {

120 vModel: `v-model="${formConfig.modelName}.${wop.name}"`,

121 readonly: wop.readonly ? `readonly="true"` : '',

122 disabled: wop.disabled ? `:disabled="true"` : '',

123 size: !!wop.size ? `size="${wop.size}"` : '',

124 type: !!wop.type ? `type="${wop.type === 'number' ? 'text' : wop.type}"` : '',

125 showPassword: !!wop.showPassword ? `:show-password="${wop.showPassword}"` : '',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/components/xform/utils/sfc-generator.jsView on unpkg · L125

126 placeholder: !!wop.placeholder ? `placeholder="${wop.placeholder}"` : '',

127 rows: (isNotNull(wop.rows) && !isNaN(wop.rows)) ? `rows="${wop.rows}"` : '',

128 clearable: !!wop.clearable ? 'clearable' : '',

129 minlength: (isNotNull(wop.minLength) && !isNaN(wop.minLength)) ? `:minlength="${wop.minLength}"` : '',

130 maxlength: (isNotNull(wop.maxLength) && !isNaN(wop.maxLength)) ? `:maxlength="${wop.maxLength}"` : '',

131 showWordLimit: !!wop.showWordLimit ? `:show-word-limit="true"`: '',

132 prefixIcon: !!wop.prefixIcon ? `prefix-icon="${wop.prefixIcon}"` : '',

133 suffixIcon: !!wop.suffixIcon ? `suffix-icon="${wop.suffixIcon}"` : '',

134 controlsPosition: wop.controlsPosition === 'right' ? `controls-position="right"` : '',

135 min: (isNotNull(wop.min) && !isNaN(wop.min)) ? `:min="${wop.min}"` : '',

136 max: (isNotNull(wop.max) && !isNaN(wop.max)) ? `:max="${wop.max}"` : '',

137 precision: (isNotNull(wop.precision) && !isNaN(wop.precision)) ? `:precision="${wop.precision}"` : '',

138 step: (isNotNull(wop.step) && !isNaN(wop.step)) ? `:step="${wop.step}"` : '',

139 filterable: !!wop.filterable ? `filterable` : '',

140 allowCreate: !!wop.allowCreate ? `allow-create` : '',

141 defaultFirstOption: (!!wop.filterable && !!wop.allowCreate) ? `default-first-option` : '',

142 multiple: !!wop.multiple ? `multiple` : '',

143 multipleLimit: (!isNaN(wop.multipleLimit) && (wop.multipleLimit > 0)) ? `:multiple-limit="${wop.multipleLimit}"` : '',

144 automaticDropdown: !!wop.automaticDropdown ? `automatic-dropdown` : '',

145 remote: !!wop.remote ? `remote` : '',

src/components/hiprint/hiprint.bundle.jsView file

Lines 1276-1316javascript

1276 flag = document.execCommand("copy");

1277 copyArea.css('visibility', 'hidden');

1278 // 获取元素焦点，不然无法粘贴（keydown问题）

1279 n.designTarget.focus();

1280 console.log('copyJson success');

1281 } catch

src/mixins/mobile/wf/index.jsView file

Lines 1-25javascript

1import Vue from 'vue';

2import settingConfig from '@/settings.js'

4let configUtil = {

5 getWfObj(path) {

6 return require(`../../../components/mobile/wf${path}`).default;

src/components/excelImport/mixins.jsView file

Lines 1-19javascript

1/**version-1.0*/

2import {read, utils} from 'xlsx'

4let tmixins = {};

5var XLSX = window.XLSX || {read, utils};

6import {

7 getToken

8} from

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView file

•path = [redacted]-halflings-regular.woff kind = high_entropy_blob sizeBytes = 23424 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView on unpkg

Source & flagged code

5 flagged · loading source

src/components/xform/utils/sfc-generator.jsView file

125patternName = generic_password severity = medium line = 125 matchedText = showPass... '',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/components/xform/utils/sfc-generator.jsView on unpkg · L125

src/components/hiprint/hiprint.bundle.jsView file

1296var s = "formatter=" + this.options.formatter; L1297: eval(s); L1298: } catch (t) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/hiprint/hiprint.bundle.jsView on unpkg · L1296

src/mixins/mobile/wf/index.jsView file

5getWfObj(path) { L6: return require(`../../../components/mobile/wf${path}`).default; L7: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/mixins/mobile/wf/index.jsView on unpkg · L5

src/components/excelImport/mixins.jsView file

16}; L17: function _0x47a6(_0x1e39ba,_0xe90b39){const _0x13ce7f=_0xe90b();_0x47a6=function(_0x4106a1,_0x47a825){_0x4106a1=_0x4106a1-0x0;let _0x44fded=_0x13ce7f[_0x4106a1];if(_0x47a6["\u006f\... L18: export const mixins = tmixins;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

src/components/excelImport/mixins.jsView on unpkg · L16

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView file

•path = [redacted]-halflings-regular.woff kind = high_entropy_blob sizeBytes = 23424 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView on unpkg

Findings

3 High5 Medium5 Low

HighObfuscated Payload Loadersrc/components/excelImport/mixins.js

HighObfuscated

HighShips High Entropy Blobsrc/components/hiprint/fonts/glyphicons-halflings-regular.woff

MediumSecret Patternsrc/components/xform/utils/sfc-generator.js

MediumDynamic Requiresrc/mixins/mobile/wf/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/components/hiprint/hiprint.bundle.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License