registry / iflow-engine-base / 4.0.16
iflow-engine-base@4.0.16
BIM Engine SDK for Vue2, Vue3, React and HTML
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source shows a user-invoked encoding feature that sends selected model properties to its configured provider, so it does not establish covert exfiltration or malicious intent. The default bearer-style key is embedded in the published bundle, creating unresolved exposure and possible unauthorized use if the key is valid; warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes OneClickEncoding.start() or chat().
Impact
If the bundled key is valid, package consumers can extract and reuse it; model coding properties are disclosed to the provider during encoding.
Mechanism
The SDK uses its bundled default bearer key for a DeepSeek chat request; start() gathers selected model element properties and submits them in batches.
AI rationale
The source shows a user-invoked encoding feature that sends selected model properties to its configured provider, so it does not establish covert exfiltration or malicious intent. The default bearer-style key is embedded in the published bundle, creating unresolved exposure and possible unauthorized use if the key is valid; warn rather than block.
Evidence
package.jsondist/index.d.tsdist/chunks/engine-3d-B0D38zLu.js
Network endpoints1
api.deepseek.com/v1/chat/completions
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package entry points load the bundled SDK.
- The public OneClickEncoding API exposes start() and chat().
- The SDK embeds a bearer-style provider key as its default and logs part of it during initialization.
- Calling start() selects model elements, gathers coding properties, and sends batches to DeepSeek.
Evidence against
- The external request is part of the named encoding feature and runs through an explicit start() call.
- The inspected source does not establish that the embedded key is valid or that the transfer is hidden or install-triggered.
Behavioral surface
CryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/chunks/sdk-vendor-CVc1LiJj.jsView file
2302}, b.setImmediate = function(_) {
L2303: typeof _ != "function" && (_ = new Function("" + _));
L2304: for (var w = new Array(arguments.length - 1), T = 0; T < w.length; T++) w[T] = arguments[T + 1];
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunks/sdk-vendor-CVc1LiJj.jsView on unpkg · L2302dist/chunks/engine-3d-B0D38zLu.jsView file
12802contains invisible/control Unicode U+200C (zero width non-joiner)
extended<U+200C> = /* @__PURE__ */ new Map();
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/chunks/engine-3d-B0D38zLu.jsView on unpkg · L12802dist/index.d.tsView file
Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-B0D38zLu.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.d.ts
HighShips High Entropy Blobdist/assets/hdr/17.hdr
HighSemantic Analysis Limiteddist/bim-engine-sdk.umd.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/chunks/sdk-vendor-CVc1LiJj.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to iflow-engine-base@4.0.16.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@4.0.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.