registry / iflow-engine-base / 4.0.14
iflow-engine-base@4.0.14
BIM Engine SDK for Vue2, Vue3, React and HTML
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe bundled DeepSeek credential is a concrete exposure risk, so a warning is appropriate. The network request is part of an explicitly invoked encoding feature, and the inspected source does not establish an attack that warrants blocking publication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer invokes the engine’s one-click encoding method.
Impact
The request can disclose selected model metadata to the API, and the exposed credential may be abused by others. The source does not establish malicious collection or credential theft.
Mechanism
The method gathers model properties and posts them to the DeepSeek chat API with the bundled credential as a bearer token.
AI rationale
The bundled DeepSeek credential is a concrete exposure risk, so a warning is appropriate. The network request is part of an explicitly invoked encoding feature, and the inspected source does not establish an attack that warrants blocking publication.
Evidence
dist/bim-engine-sdk.umd.jsdist/chunks/engine-3d-O9j7G-bi.js
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest routes package consumers to the bundled runtime.
- The shipped bundle contains a default API credential and selects the DeepSeek API endpoint.
- The engine exposes a one-click encoding method that gathers model properties when called.
- That method sends the gathered data in an authenticated request to DeepSeek.
Evidence against
- The manifest has no install lifecycle hook; the remote request is reached through the runtime encoding method.
- The endpoint and request purpose match the encoding feature, and source inspection did not establish credential theft or another attack.
Behavioral surface
CryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/chunks/sdk-vendor-DtYOqJWo.jsView file
4879}, C.setImmediate = function(T) {
L4880: typeof T != "function" && (T = new Function("" + T));
L4881: for (var w = new Array(arguments.length - 1), b = 0; b < w.length; b++) w[b] = arguments[b + 1];
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunks/sdk-vendor-DtYOqJWo.jsView on unpkg · L4879dist/chunks/engine-3d-O9j7G-bi.jsView file
11724contains invisible/control Unicode U+200C (zero width non-joiner)
extended<U+200C> = /* @__PURE__ */ new Map();
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/chunks/engine-3d-O9j7G-bi.jsView on unpkg · L11724•Trigger-reachable chain: manifest.module -> dist/bim-engine-sdk.es.js -> dist/chunks/engine-3d-O9j7G-bi.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-O9j7G-bi.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/engine-3d-O9j7G-bi.js
HighShips High Entropy Blobdist/assets/hdr/17.hdr
HighSemantic Analysis Limiteddist/bim-engine-sdk.umd.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/chunks/sdk-vendor-DtYOqJWo.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to iflow-engine-base@4.0.14.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@4.0.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.