registry / iflow-engine-base / 4.0.12
iflow-engine-base@4.0.12
⚠ Under reviewBIM Engine SDK for Vue2, Vue3, React and HTML
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe inspected network behavior supports an exposed, caller-invoked encoding feature and does not establish an attack. A clean verdict requires citations for 373 distinct paths, exceeding the 256-citation limit, so the result remains manual review.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes the one-click encoding helper.
Impact
The service receives the submitted model data; no malicious impact was established.
Mechanism
The helper gathers model properties, batches them, and posts them with a bundled fallback API key to the configured DeepSeek endpoint.
AI rationale
The inspected network behavior supports an exposed, caller-invoked encoding feature and does not establish an attack. A clean verdict requires citations for 373 distinct paths, exceeding the 256-citation limit, so the result remains manual review.
Evidence
dist/chunks/engine-3d-DTgYyZJM.jsdist/index.d.tspackage.json
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Manual Review at 53.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest routes package imports to the bundled runtime entrypoints.
- The public API exposes a one-click encoding helper that gathers model properties and sends batches for encoding.
- The helper posts prompts to DeepSeek using a bundled fallback API key.
- The focused inspection found a user-invoked product feature, not independent malicious behavior; clean citation coverage exceeds the 256-reference limit.
Evidence against
Behavioral surface
CryptoDynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
8 flaggeddist/chunks/sdk-vendor-DXennwpt.jsView file
2274}, m.setImmediate = function(E) {
L2275: typeof E != "function" && (E = new Function("" + E));
L2276: for (var T = new Array(arguments.length - 1), C = 0; C < T.length; C++) T[C] = arguments[C + 1];
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunks/sdk-vendor-DXennwpt.jsView on unpkg · L2274dist/draco/draco_decoder.jsView file
7L8: var Module=typeof DracoDecoderModule!="undefined"?DracoDecoderModule:{};var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise(function(resolve,reject){readyPromise...
L9: // EMSCRIPTEN_START_ASM
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/draco/draco_decoder.jsView on unpkg · L7dist/chunks/engine-3d-DTgYyZJM.jsView file
Findings
2 Critical2 High5 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-DTgYyZJM.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.d.ts
HighShips High Entropy Blobdist/assets/hdr/17.hdr
HighSemantic Analysis Limiteddist/Cesium/Workers/transcodeKTX2.js#virtual:normalized:round1
MediumDynamic Requiredist/draco/draco_decoder.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/chunks/sdk-vendor-DXennwpt.js
LowFilesystem
Low
Affected versions and remediation
This report applies to iflow-engine-base@4.0.12.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@4.0.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.