registry / iflow-engine-base / 4.0.13
iflow-engine-base@4.0.13
⚠ Under reviewBIM Engine SDK for Vue2, Vue3, React and HTML
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe inspected request is tied to an explicit encoding operation and does not establish malicious behavior. The required clean citation coverage exceeds the schema limit, so the package needs manual review rather than a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes the encoding feature’s start method.
Impact
The service receives model data for encoding. The inspected flow does not establish credential theft or another attack.
Mechanism
The feature gathers component identifiers and properties, then sends them in a chat request authenticated with a built-in fallback API key.
AI rationale
The inspected request is tied to an explicit encoding operation and does not establish malicious behavior. The required clean citation coverage exceeds the schema limit, so the package needs manual review rather than a clean verdict.
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Manual Review at 77.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest points consumers to built SDK files and its listed scripts are development and build commands.
- The SDK constructs the encoding feature with the engine and no caller-supplied key.
- Calling the encoding feature’s start method gathers model component identifiers and properties for encoding.
- The feature sends chat requests to api.deepseek.com using a built-in fallback API key.
- The public type declaration exposes the encoding feature and allows an optional API key.
- The required clean-review citation set exceeds the 256-citation limit, so clean coverage cannot be verified here.
Evidence against
- The inspected manifest excerpt shows no install lifecycle hook.
- The external request is part of the encoding feature and is reached through its start method; the inspected code does not establish a separate attack.
Behavioral surface
CryptoDynamicRequireEvalFilesystemNetwork
Source & flagged code
8 flaggeddist/Cesium/Workers/transcodeKTX2.jsView file
25L26: import{a as on}from"./chunk-XR7MN4PJ.js";import{a as f}from"./chunk-DC3K7YTH.js";import{a as se}from"./chunk-PQ3V63XF.js";import{b as sn}from"./chunk-GF67PEXE.js";import{a as Vt,c ...
L27: "use strict"; return body.apply(this, arguments);
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/Cesium/Workers/transcodeKTX2.jsView on unpkg · L25dist/draco/draco_decoder.jsView file
7L8: var Module=typeof DracoDecoderModule!="undefined"?DracoDecoderModule:{};var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise(function(resolve,reject){readyPromise...
L9: // EMSCRIPTEN_START_ASM
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/draco/draco_decoder.jsView on unpkg · L7dist/chunks/EngineKernel-t9Cw-9so.js
Findings
2 Critical2 High5 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/EngineKernel-t9Cw-9so.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.d.ts
HighShips High Entropy Blobdist/assets/hdr/17.hdr
HighSemantic Analysis Limiteddist/Cesium/Workers/transcodeKTX2.js#virtual:normalized:round1
MediumDynamic Requiredist/draco/draco_decoder.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/Cesium/Workers/transcodeKTX2.js
LowFilesystem
Affected versions and remediation
This report applies to iflow-engine-base@4.0.13.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@4.0.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.