registry / cloud-web-corejs / 1.0.250

cloud-web-corejs@1.0.250

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Risky primitives are browser-side Vue application features for importing/exporting files, printing, routing, and app API calls.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports spreadsheets, uses print/upload/UI workflow components, or runs the Vue app.

Impact

No install-time execution, persistence, credential exfiltration, or destructive behavior identified.

Mechanism

package-aligned frontend components and app API calls

Rationale

Static inspection shows a Vue component library/application package with obfuscated but package-aligned import logic and bundled UI code, not an install-time or import-time payload. Network and token use route through the host app's configured API base or documented print/upload services, with no concrete exfiltration or persistence behavior found.

Evidence

package.jsonsrc/components/excelImport/mixins.jssrc/components/hiprint/hiprint.bundle.jssrc/utils/request.jssrc/utils/auth.jssrc/mixins/mobile/wf/index.jssrc/components/wf/wfUtil.jssrc/store/modules/permission.js

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for block

src/components/excelImport/mixins.js is heavily obfuscated and posts imported spreadsheet rows via this.$http to configured app endpoints.
src/components/hiprint/hiprint.bundle.js contains eval/new Function patterns in bundled print/designer code.

Evidence against

package.json has no preinstall/install/postinstall/prepare hooks and no bin/main entrypoint.
src/utils/request.js sends requests to process.env.VUE_APP_BASE_API with the app token for normal Vue API calls.
src/mixins/mobile/wf/index.js and src/components/wf/wfUtil.js use dynamic require only for local Vue workflow components.
src/utils/auth.js stores and reads the app token from sessionStorage; no credential harvesting or external exfiltration found.
No child_process, filesystem writes, persistence hooks, AI-agent control-surface writes, or lifecycle mutation found in inspected sources.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 258 file(s), 3.73 MB of source, external domains: cainiao-oss-sh-read.oss-cn-shanghai.aliyuncs.com, cdn.bootcss.com, cdn.staticfile.org, cloudprint.cainiao.com, file-link.pinduoduo.com, github.com, hiprint.io, ks3-cn-beijing.ksyun.com, ks3-cn-beijing.ksyuncs.com, lf26-cdn-tos.bytecdntp.com, map.baidu.com, meta.pinduoduo.com, obs.cn-south-1.myhuaweicloud.com, portrait.gitee.com, prod-oms-app-cprt.jdwl.com, vos.vipstatic.com, www.vform666.com, www.w3.org, xhswaybill-printer-1251524319.cos.ap-shanghai.myqcloud.com

Source & flagged code

5 flagged

src/components/xform/utils/sfc-generator.jsView file

Lines 105-145javascript

105 },

106

107 'sub-form': (ctn, formConfig) => {

108 //TODO:

109 },

110

111}

112

113export function buildContainerWidget(widget, formConfig) {

114 return containerTemplates[widget.type] ? containerTemplates[widget.type](widget, formConfig) : null

115}

116

117function getElAttrs(widget, formConfig) { //获取El组件属性

118 let wop = widget.options

119 return {

120 vModel: `v-model="${formConfig.modelName}.${wop.name}"`,

121 readonly: wop.readonly ? `readonly="true"` : '',

122 disabled: wop.disabled ? `:disabled="true"` : '',

123 size: !!wop.size ? `size="${wop.size}"` : '',

124 type: !!wop.type ? `type="${wop.type === 'number' ? 'text' : wop.type}"` : '',

125 showPassword: !!wop.showPassword ? `:show-password="${wop.showPassword}"` : '',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/components/xform/utils/sfc-generator.jsView on unpkg · L125

126 placeholder: !!wop.placeholder ? `placeholder="${wop.placeholder}"` : '',

127 rows: (isNotNull(wop.rows) && !isNaN(wop.rows)) ? `rows="${wop.rows}"` : '',

128 clearable: !!wop.clearable ? 'clearable' : '',

129 minlength: (isNotNull(wop.minLength) && !isNaN(wop.minLength)) ? `:minlength="${wop.minLength}"` : '',

130 maxlength: (isNotNull(wop.maxLength) && !isNaN(wop.maxLength)) ? `:maxlength="${wop.maxLength}"` : '',

131 showWordLimit: !!wop.showWordLimit ? `:show-word-limit="true"`: '',

132 prefixIcon: !!wop.prefixIcon ? `prefix-icon="${wop.prefixIcon}"` : '',

133 suffixIcon: !!wop.suffixIcon ? `suffix-icon="${wop.suffixIcon}"` : '',

134 controlsPosition: wop.controlsPosition === 'right' ? `controls-position="right"` : '',

135 min: (isNotNull(wop.min) && !isNaN(wop.min)) ? `:min="${wop.min}"` : '',

136 max: (isNotNull(wop.max) && !isNaN(wop.max)) ? `:max="${wop.max}"` : '',

137 precision: (isNotNull(wop.precision) && !isNaN(wop.precision)) ? `:precision="${wop.precision}"` : '',

138 step: (isNotNull(wop.step) && !isNaN(wop.step)) ? `:step="${wop.step}"` : '',

139 filterable: !!wop.filterable ? `filterable` : '',

140 allowCreate: !!wop.allowCreate ? `allow-create` : '',

141 defaultFirstOption: (!!wop.filterable && !!wop.allowCreate) ? `default-first-option` : '',

142 multiple: !!wop.multiple ? `multiple` : '',

143 multipleLimit: (!isNaN(wop.multipleLimit) && (wop.multipleLimit > 0)) ? `:multiple-limit="${wop.multipleLimit}"` : '',

144 automaticDropdown: !!wop.automaticDropdown ? `automatic-dropdown` : '',

145 remote: !!wop.remote ? `remote` : '',

src/components/hiprint/hiprint.bundle.jsView file

Lines 1276-1316javascript

1276 flag = document.execCommand("copy");

1277 copyArea.css('visibility', 'hidden');

1278 // 获取元素焦点，不然无法粘贴（keydown问题）

1279 n.designTarget.focus();

1280 console.log('copyJson success');

1281 } catch

src/mixins/mobile/wf/index.jsView file

Lines 1-25javascript

1import Vue from 'vue';

2import settingConfig from '@/settings.js'

4let configUtil = {

5 getWfObj(path) {

6 return require(`../../../components/mobile/wf${path}`).default;

src/components/excelImport/mixins.jsView file

Lines 1-19javascript

1/**version-1.0*/

2import {read, utils} from 'xlsx'

4let tmixins = {};

5var XLSX = window.XLSX || {read, utils};

6import {

7 getToken

8} from

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView file

•path = [redacted]-halflings-regular.woff kind = high_entropy_blob sizeBytes = 23424 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView on unpkg

Source & flagged code

5 flagged · loading source

src/components/xform/utils/sfc-generator.jsView file

125patternName = generic_password severity = medium line = 125 matchedText = showPass... '',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/components/xform/utils/sfc-generator.jsView on unpkg · L125

src/components/hiprint/hiprint.bundle.jsView file

1296var s = "formatter=" + this.options.formatter; L1297: eval(s); L1298: } catch (t) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/hiprint/hiprint.bundle.jsView on unpkg · L1296

src/mixins/mobile/wf/index.jsView file

5getWfObj(path) { L6: return require(`../../../components/mobile/wf${path}`).default; L7: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/mixins/mobile/wf/index.jsView on unpkg · L5

src/components/excelImport/mixins.jsView file

16}; L17: function _0x47a6(_0x1e39ba,_0xe90b39){const _0x13ce7f=_0xe90b();_0x47a6=function(_0x4106a1,_0x47a825){_0x4106a1=_0x4106a1-0x0;let _0x44fded=_0x13ce7f[_0x4106a1];if(_0x47a6["\u006f\... L18: export const mixins = tmixins;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

src/components/excelImport/mixins.jsView on unpkg · L16

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView file

•path = [redacted]-halflings-regular.woff kind = high_entropy_blob sizeBytes = 23424 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView on unpkg

Findings

3 High5 Medium5 Low

HighObfuscated Payload Loadersrc/components/excelImport/mixins.js

HighObfuscated

HighShips High Entropy Blobsrc/components/hiprint/fonts/glyphicons-halflings-regular.woff

MediumSecret Patternsrc/components/xform/utils/sfc-generator.js

MediumDynamic Requiresrc/mixins/mobile/wf/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/components/hiprint/hiprint.bundle.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License