registry / ct-answer-designer / 1.1.4
ct-answer-designer@1.1.4
Vue3工单组件库，包含PC端和移动端工单组件
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found a browser component library with no registry install hook. Its network behavior is feature-aligned and uses configured or fixed service endpoints; no concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer uses the component or sends an AI chat request through its user interface.
Impact
No confirmed malicious behavior, install-time execution, credential harvesting, persistence, or destructive action was found.
Mechanism
Requests use fixed service endpoints or an endpoint and token supplied through consumer configuration.
AI rationale
Static inspection found a browser component library with no registry install hook. Its network behavior is feature-aligned and uses configured or fixed service endpoints; no concrete attack behavior was found.
Network endpoints2
ct-test.hep.com.cn/ct-api-onlineapi.form-create.com/ai/v1/chat/form
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package scripts contain development, build, preview, and prepublish-only commands; there is no install lifecycle hook.
- The main browser bundle configures a fixed service API and attaches its stored token as ordinary bearer authentication.
- The web-component bundle uses the same fixed service API pattern.
- The SDK AI endpoint and token are obtained from consumer configuration, with a package default endpoint.
- The SDK sends the current chat message and form rule only when its UI fetch method is invoked.
Evidence against
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/ct-answer-designer.umd.jsView file
563* @license MIT
L564: */function nk(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(o){return Object.getOwnPropertyDescriptor(e,o...
L565: * @form-create/component-elm-select v3.2.31
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/ct-answer-designer.umd.jsView on unpkg · L5631(function(xn,i){typeof exports=="object"&&typeof module<"u"?i(exports,require("vue"),require("element-plus"),require("axios"),require("vant")):typeof define=="function"&&define.amd...
L2: `),function(d){if(u=d.indexOf(":"),l=r.trim(d.substr(0,u)).toLowerCase(),s=r.trim(d.substr(u+1)),l){if(c[l]&&o.indexOf(l)>=0)return;c[l]=l==="set-cookie"?(c[l]?c[l]:[]).concat([s])...
L3: QueryAppInfoByAppID(appId: $appId, responseType: $responseType, redirectUrl: $redirectUrl) {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/ct-answer-designer.umd.jsView on unpkg · L1dist/ct-answer-designer-wc.umd.jsView file
Findings
1 Critical3 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/ct-answer-designer-sdk.iife.js
HighSame File Env Network Executiondist/ct-answer-designer-wc.umd.js
HighBase64 Obscured Urldist/ct-answer-designer.umd.js
HighSemantic Analysis Limiteddist/ct-answer-designer-sdk.es.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/ct-answer-designer.es.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/ct-answer-designer.umd.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to ct-answer-designer@1.1.4.
See all versions of ct-answer-designer for other recorded verdicts.
- Review the evidence and your use of ct-answer-designer@1.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.