registry / iflow-engine-base / 4.1.10
iflow-engine-base@4.1.10
BIM Engine SDK for Vue2, Vue3, React and HTML
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s network behavior is tied to an explicitly started AI-assisted encoding feature: it sends selected BIM properties to DeepSeek to generate codes. The bundled API key and its partial console logging are poor credential hygiene, but the reviewed source does not show malicious use or unrelated automatic data collection.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An application explicitly calls the encoding feature’s start method.
Impact
The selected BIM properties leave the application for processing by DeepSeek; this matches the feature’s coding purpose.
Mechanism
The feature gathers properties for selected model components, batches them, and posts them to DeepSeek’s chat completions API using a bundled API key.
AI rationale
The package’s network behavior is tied to an explicitly started AI-assisted encoding feature: it sends selected BIM properties to DeepSeek to generate codes. The bundled API key and its partial console logging are poor credential hygiene, but the reviewed source does not show malicious use or unrelated automatic data collection.
Network endpoints1
api.deepseek.com/v1/chat/completions
Decision evidence
public snapshotAI called this Clean at 85.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package is a BIM engine SDK, and its main entry points are built distribution bundles.
- The encoding feature gathers selected model properties and processes them in batches when its start method is called.
- The feature sends those batches to DeepSeek’s chat completions API to generate model codes.
- No install lifecycle scripts are declared in the package manifest.
Evidence against
- The feature uses a hard-coded DeepSeek API key and logs its first eight characters during initialization.
- Calling the encoding feature sends BIM model data to a third-party endpoint; this is consistent with the feature’s AI encoding purpose.
Behavioral surface
CryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddistGaussian/gaussian.umd.jsView file
1(function(rt,St){typeof exports=="object"&&typeof module<"u"?St(exports,require("three"),require("@mkkellogg/gaussian-splats-3d")):typeof define=="function"&&define.amd?define(["ex...
L2: \0`,ie+=g(Q,2),ie+=C.magic,ie+=g(m,2),ie+=g(_,2),ie+=g(oe.crc32,4),ie+=g(oe.compressedSize,4),ie+=g(oe.uncompressedSize,4),ie+=g(i.length,2),ie+=g(H.length,2),{fileRecord:T.LOCAL_F...
L3: `)}return u},a.decode=function(d,x){if(typeof d!="string")throw new TypeError('"input" must be a string.');if(typeof x!="string")throw new TypeError('"alphabet" must be a string.')...
Low
Eval
Package source references a known benign dynamic code generation pattern.
distGaussian/gaussian.umd.jsView on unpkg · L1dist/chunks/engine-3d-Dtz7djOT.jsView file
14213contains invisible/control Unicode U+200C (zero width non-joiner)
extended<U+200C> = /* @__PURE__ */ new Map();
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/chunks/engine-3d-Dtz7djOT.jsView on unpkg · L14213Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-Dtz7djOT.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.d.ts
HighShips High Entropy Blobdist/assets/hdr/17.hdr
HighSemantic Analysis Limiteddist/bim-engine-sdk.umd.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldistGaussian/gaussian.umd.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to iflow-engine-base@4.1.10.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@4.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.