registry / iflow-engine-base / 4.1.9
iflow-engine-base@4.1.9
BIM Engine SDK for Vue2, Vue3, React and HTML
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis BIM SDK’s DeepSeek request is part of its encoding feature and runs when that feature is started, rather than automatically on installation or import. The bundled API key is exposed and partially logged, but the reviewed code does not show it being used for unrelated actions.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes the engine’s OneClickEncoding start() method.
Impact
Selected BIM component data is transmitted to DeepSeek for encoding. The bundled key is exposed in the package and its first eight characters are logged.
Mechanism
The method selects matching model components and submits their data to DeepSeek using a hard-coded API key; engine setup alone does not make the request.
AI rationale
This BIM SDK’s DeepSeek request is part of its encoding feature and runs when that feature is started, rather than automatically on installation or import. The bundled API key is exposed and partially logged, but the reviewed code does not show it being used for unrelated actions.
Network endpoints3
api.deepseek.com/v1/chat/completionswebrd01.is.autonavi.com/appmaptilewebst01.is.autonavi.com/appmaptile
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a BIM engine SDK and has no install lifecycle scripts.
- The engine creates a OneClickEncoding helper as part of engine setup; its encoding work is initiated by calling start().
- The encoding method sends selected model component data to DeepSeek for encoding.
Evidence against
- The helper contains a hard-coded API key and logs its first eight characters when constructed.
- The package sends model data to api.deepseek.com when encoding is started.
Behavioral surface
CryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddistGaussian/gaussian.umd.jsView file
1(function(rt,St){typeof exports=="object"&&typeof module<"u"?St(exports,require("three"),require("@mkkellogg/gaussian-splats-3d")):typeof define=="function"&&define.amd?define(["ex...
L2: \0`,ie+=g(Q,2),ie+=C.magic,ie+=g(m,2),ie+=g(_,2),ie+=g(oe.crc32,4),ie+=g(oe.compressedSize,4),ie+=g(oe.uncompressedSize,4),ie+=g(i.length,2),ie+=g(H.length,2),{fileRecord:T.LOCAL_F...
L3: `)}return u},a.decode=function(d,x){if(typeof d!="string")throw new TypeError('"input" must be a string.');if(typeof x!="string")throw new TypeError('"alphabet" must be a string.')...
Low
Eval
Package source references a known benign dynamic code generation pattern.
distGaussian/gaussian.umd.jsView on unpkg · L1dist/chunks/engine-3d-cz2yEP2W.jsView file
14213contains invisible/control Unicode U+200C (zero width non-joiner)
extended<U+200C> = /* @__PURE__ */ new Map();
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/chunks/engine-3d-cz2yEP2W.jsView on unpkg · L14213Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-cz2yEP2W.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.d.ts
HighShips High Entropy Blobdist/assets/hdr/17.hdr
HighSemantic Analysis Limiteddist/bim-engine-sdk.umd.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldistGaussian/gaussian.umd.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to iflow-engine-base@4.1.9.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@4.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.