registry / ct-answer-designer / 1.1.2
ct-answer-designer@1.1.2
Vue3工单组件库，包含PC端和移动端工单组件
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected execution paths are consistent with the package's work-order and form-design functionality. Dynamic evaluation and encoded vendor telemetry do not establish a concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Import registers components; caller initialization and component interaction activate work-order functionality.
Impact
No malicious installation, credential theft, destructive mutation, or agent control hijacking was established.
Mechanism
Browser components call service APIs and evaluate form expressions; sampled vendor telemetry reports the page host and license value.
AI rationale
The inspected execution paths are consistent with the package's work-order and form-design functionality. Dynamic evaluation and encoded vendor telemetry do not establish a concrete malicious chain.
Network endpoints1
ct-test.hep.com.cn/ct-api-online
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines build scripts and prepublishOnly, with no registry install hooks or runtime self-dependency.
- The web component bundle registers work-order custom elements.
- Both SDK formats require a caller-selected container and work order before mounting components.
- Dynamic expressions run within the form engine's formula and rule context.
- Authentication uses a fixed HEP API endpoint and adds the service token to requests.
- Bundled FormCreate telemetry sends the page host and license value to its vendor using a sampled image request.
Evidence against
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/ct-answer-designer.umd.jsView file
563* @license MIT
L564: */function nk(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(o){return Object.getOwnPropertyDescriptor(e,o...
L565: * @form-create/component-elm-select v3.2.31
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/ct-answer-designer.umd.jsView on unpkg · L5631(function(xn,i){typeof exports=="object"&&typeof module<"u"?i(exports,require("vue"),require("element-plus"),require("axios"),require("vant")):typeof define=="function"&&define.amd...
L2: `),function(d){if(u=d.indexOf(":"),l=r.trim(d.substr(0,u)).toLowerCase(),s=r.trim(d.substr(u+1)),l){if(c[l]&&o.indexOf(l)>=0)return;c[l]=l==="set-cookie"?(c[l]?c[l]:[]).concat([s])...
L3: QueryAppInfoByAppID(appId: $appId, responseType: $responseType, redirectUrl: $redirectUrl) {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/ct-answer-designer.umd.jsView on unpkg · L1dist/ct-answer-designer-wc.umd.jsView file
Findings
1 Critical3 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/ct-answer-designer-sdk.iife.js
HighSame File Env Network Executiondist/ct-answer-designer-wc.umd.js
HighBase64 Obscured Urldist/ct-answer-designer.umd.js
HighSemantic Analysis Limiteddist/ct-answer-designer-sdk.es.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/ct-answer-designer.es.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/ct-answer-designer.umd.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to ct-answer-designer@1.1.2.
See all versions of ct-answer-designer for other recorded verdicts.
- Review the evidence and your use of ct-answer-designer@1.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.