mvframe@1.1.32: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

mvframe@1.1.32: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

scripts/copy-flag-assets.jsView file

6L7: const fs = require("fs"); L8: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

scripts/scaffold-app.jsView file

12Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L12: * --force, -f 覆盖已存在的脚手架文件 L13: * --no-package-json, -n 不读不写 package.json（仅生成源码与 Vite 配置） L14: */ ... L17: const path = require("path"); L18: const { execFileSync } = require("child_process"); L19: const { upsertCodexAgents } = require("./install-codex-agents.js"); ... L27: const target = path.resolve( L28: process.env.MVFRAME_SCAFFOLD_TARGET || argPath || process.cwd(), L29: ); ... L92: const TEST_DINGTALK_WEBHOOK = L93: "https://oapi.dingtalk.com/robot/send?access_token=[redacted]"; L94: const TEST_DINGTALK_SECRET =

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/scaffold-app.jsView on unpkg · L12

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg

Source & flagged code

4 flagged

scripts/copy-flag-assets.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Copy flag-icons SVG assets beside the built host bundle.

4 * `src/style/chip/flag-icons.scss` points CSS URLs at `/assets/flags/...`.

5 */

6

7const fs = require("fs");

8const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

9const { createRequire } = require("module");

10const { execFileSync } = require("child_process");

11

12const root = path.resolve(__dirname, "..");

13const pnpPath = path.join(root, ".pnp.cjs");

14

15if (fs.existsSync(pnpPath)) {

16 require(pnpPath).setup();

17}

18

19const projectRequire = createRequire(path.join(root, "package.json"));

20const flagPackagePath = projectRequire.resolve("flag-icons/package.json");

21const flagRoot = path.dirname(flagPackagePath);

22const src = path.join(flagRoot, "flags");

23const dest = path.join(root, "dist", "assets", "flags");

24

25function copyFromZip(zipBackedPath, target) {

26 const marker = ".zip/";

scripts/scaffold-app.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 在目标工程生成 MVFrame 推荐目录与雏形文件（views / component / api / pinia / router / config / assets）。

4 *

5 * 用法：

6 * node path/to/mvframe/scripts/scaffold-app.js [项目根] [--force|-f]

7 * yarn exec mvframe-init-app

8 *

9 * 环境变量：MVFRAME_SCAFFOLD_TARGET=/path/to/project

10 *

11 * 选项：

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg