vue-layout-gitcode@1.12.15-beta.49
用于 gitcode 站点生产环境使用
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no lifecycle hook or confirmed malicious behavior. However, it forwards an existing token to an unrestricted configuration-controlled API host, creating a conditional credential-exposure capability.
Static reason
One or more suspicious static signals were detected.
Trigger
A component makes a default API request after its API host has been overridden and a stored token exists.
Impact
A consumer-configured untrusted API host could receive the bearer token.
Mechanism
The request interceptor reads local storage and attaches the token to non-whitelisted requests; the configuration setter does not restrict the API host.
AI rationale
The package has no lifecycle hook or confirmed malicious behavior. However, it forwards an existing token to an unrestricted configuration-controlled API host, creating a conditional credential-exposure capability.
Evidence
index-D27sLwSF.js
Network endpoints1
web-api.gitcode.com
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest identifies index.js as the package entrypoint and has no lifecycle hook.
- The exported configuration setter accepts arbitrary configuration values, including the API host.
- The default request handler reads the stored access token and adds it as a Bearer header.
- A component uses that request handler by default.
Evidence against
- The inspected default API host is the GitCode service endpoint.
- No install-time execution, shell execution, or credential exfiltration endpoint was identified.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
6 flaggedindex-D27sLwSF.jsView file
8392patternName = generic_password
severity = medium
line = 8392
Medium
130const layoutConfig$7 = reactive({ ...defaultConfig });
function setLayoutConfig(customConfig) {
Object.assign(layoutConfig$7, customConfig);
}
funct
Medium
Ai Review Evidence
The exported configuration setter accepts arbitrary configuration values, including the API host.
index-D27sLwSF.jsView on unpkg · L1308960service.interceptors.request.use(
(config) => {
var _a, _b;
const access_token = localStorage$2.getItem("access_token");
const { url } = config;
if (access_token && !notAuthorization(url)) {
config.headers.Authorization = `Bearer ${access_token}`;
}
config.headers["page-title"] = "%E9%A6%96%E9%A1%B5";
c
Medium
Ai Review Evidence
The default request handler reads the stored access token and adds it as a Bearer header.
index-D27sLwSF.jsView on unpkg · L8960Findings
7 Medium4 Low
MediumSecret Patternindex-D27sLwSF.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex-D27sLwSF.js
MediumAi Review Evidenceindex-D27sLwSF.js
MediumAi Review Evidenceindex-D27sLwSF.js
LowEvalindex-D27sLwSF.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.15-beta.49.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.15-beta.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.