registry / iflow-engine-base / 4.1.2
iflow-engine-base@4.1.2
⚠ Under reviewBIM Engine SDK for Vue2, Vue3, React and HTML
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source shows an initialized encoding feature that sends requests to DeepSeek using a built-in key, but the inspected behavior does not establish an attack. Clean status requires citations for 372 distinct paths, exceeding the 256 citation limit, so the result remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The helper is initialized with the engine; a chat request occurs when its chat method is called.
Impact
The request exposes the built-in key and supplied content to the configured service; the inspected excerpts do not establish covert collection or other attack behavior.
Mechanism
The request includes the helper's API key as a bearer credential and sends the supplied message content to the chat endpoint.
AI rationale
The source shows an initialized encoding feature that sends requests to DeepSeek using a built-in key, but the inspected behavior does not establish an attack. Clean status requires citations for 372 distinct paths, exceeding the 256 citation limit, so the result remains unresolved.
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Manual Review at 58.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The engine creates its encoding helper during initialization and gives it a built-in API key.
- The helper sends chat requests with that key to the DeepSeek chat endpoint.
- The manifest lists development and build scripts but no npm lifecycle hook.
Evidence against
- The inspected request is part of the model encoding feature; these excerpts do not establish hidden collection or an attack.
Behavioral surface
CryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Oversized source lightweight scan
Source & flagged code
7 flaggeddistGaussian/gaussian.umd.jsView file
1(function(rt,St){typeof exports=="object"&&typeof module<"u"?St(exports,require("three"),require("@mkkellogg/gaussian-splats-3d")):typeof define=="function"&&define.amd?define(["ex...
L2: \0`,ie+=g(Q,2),ie+=C.magic,ie+=g(m,2),ie+=g(_,2),ie+=g(oe.crc32,4),ie+=g(oe.compressedSize,4),ie+=g(oe.uncompressedSize,4),ie+=g(i.length,2),ie+=g(H.length,2),{fileRecord:T.LOCAL_F...
L3: `)}return u},a.decode=function(d,x){if(typeof d!="string")throw new TypeError('"input" must be a string.');if(typeof x!="string")throw new TypeError('"alphabet" must be a string.')...
Low
Eval
Package source references a known benign dynamic code generation pattern.
distGaussian/gaussian.umd.jsView on unpkg · L1dist/chunks/engine-3d-6rggo3Ns.jsView file
14150contains invisible/control Unicode U+200C (zero width non-joiner)
extended<U+200C> = /* @__PURE__ */ new Map();
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/chunks/engine-3d-6rggo3Ns.jsView on unpkg · L14150Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-6rggo3Ns.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.d.ts
HighShips High Entropy Blobdist/assets/hdr/17.hdr
HighSemantic Analysis Limiteddist/bim-engine-sdk.umd.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldistGaussian/gaussian.umd.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to iflow-engine-base@4.1.2.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@4.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.