registry / ct-answer-designer / 1.1.6
ct-answer-designer@1.1.6
Vue3工单组件库，包含PC端和移动端工单组件
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe manifest has no registry install hook, and the high-risk network findings resolve to sampled host/license telemetry and product-specific authentication and AI requests. The inspected transfers are consistent with the bundled component functionality and do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package import enables the sampled telemetry; authentication and AI requests occur through their respective features.
Impact
The observed transfers serve those product functions; no unrelated credential recipient, destructive action, or install-time mutation was found.
Mechanism
Telemetry sends the page host and form-create license to api.form-create.com in a sampled request. The SDK also exchanges an Authing session with its application API and supports configured AI requests.
AI rationale
The manifest has no registry install hook, and the high-risk network findings resolve to sampled host/license telemetry and product-specific authentication and AI requests. The inspected transfers are consistent with the bundled component functionality and do not establish malicious behavior.
Network endpoints5
api.form-create.comct-test.hep.com.cncore.u2.hep.com.cnusers.u2.hep.com.cnoauth.u2.hep.com.cn
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json defines build scripts and a prepublishOnly build, with no install lifecycle hook.
- The bundled form-create code reports only the page host and form-create license to api.form-create.com, sampled at ten percent.
- The web-component bundles register the package's work-order components.
- The SDK configures Authing for the hep.com.cn service and sends the resulting login exchange to its application API.
- The SDK's AI feature uses a configured endpoint and token, defaulting to api.form-create.com.
Evidence against
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/ct-answer-designer.umd.jsView file
563* @license MIT
L564: */function rC(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(i){return Object.getOwnPropertyDescriptor(e,i...
L565: * @form-create/component-elm-select v3.2.31
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/ct-answer-designer.umd.jsView on unpkg · L5631(function(xn,o){typeof exports=="object"&&typeof module<"u"?o(exports,require("vue"),require("element-plus"),require("axios"),require("vant")):typeof define=="function"&&define.amd...
L2: `),function(d){if(u=d.indexOf(":"),l=r.trim(d.substr(0,u)).toLowerCase(),s=r.trim(d.substr(u+1)),l){if(c[l]&&i.indexOf(l)>=0)return;c[l]=l==="set-cookie"?(c[l]?c[l]:[]).concat([s])...
L3: QueryAppInfoByAppID(appId: $appId, responseType: $responseType, redirectUrl: $redirectUrl) {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/ct-answer-designer.umd.jsView on unpkg · L1dist/ct-answer-designer-wc.umd.jsView file
Findings
1 Critical3 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/ct-answer-designer-sdk.iife.js
HighSame File Env Network Executiondist/ct-answer-designer-wc.umd.js
HighBase64 Obscured Urldist/ct-answer-designer.umd.js
HighSemantic Analysis Limiteddist/ct-answer-designer-sdk.es.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/ct-answer-designer-sdk.es.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/ct-answer-designer.umd.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to ct-answer-designer@1.1.6.
See all versions of ct-answer-designer for other recorded verdicts.
- Review the evidence and your use of ct-answer-designer@1.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.