iflow-engine-base
BIM Engine SDK for Vue2, Vue3, React and HTML
This report shows the evidence for iflow-engine-base@4.1.20. 0 of 38 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 14h ago · by lpm-firewall-aiThe flagged network behavior implements an AI-assisted BIM encoding feature: it gathers model properties and submits them to DeepSeek when started. The inspected manifest has no install lifecycle scripts, and no unrelated collection or attack behavior was identified.
Decision evidence
public snapshot- The package is a BIM engine SDK and its main export is a built distribution bundle.
- OneClickEncoding.start() selects model components and requests their properties for encoding.
- The encoding feature sends the supplied data to DeepSeek’s chat completions endpoint using its configured or built-in API key.
- The network request is part of the named model-encoding feature and is reached through its start() method; no install hook is declared.
- The request sends model properties as the user message, not discovered credentials or unrelated files.
Source & flagged code
7 flaggedPackage source references a known benign dynamic code generation pattern.
dist/chunks/sdk-vendor-3G5leDKK.jsView on unpkg · L13713Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/chunks/engine-3d-BJzGZJoM.jsView on unpkg · L14369Findings
Affected versions and remediation
This report applies to iflow-engine-base@4.1.20.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of iflow-engine-base@4.1.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.