registry / vue-layout-gitcode / 1.12.36
vue-layout-gitcode@1.12.36
用于 gitcode 站点生产环境使用
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found a frontend layout entrypoint without lifecycle execution or a concrete malicious data flow. The remote script loads are package-aligned captcha functionality rather than a confirmed attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A consuming application invokes the captcha loader.
Impact
The application relies on the named CDN scripts; no confirmed exfiltration, persistence, or destructive behavior was established.
Mechanism
The browser app appends captcha script elements from the GitCode CDN.
AI rationale
Static inspection found a frontend layout entrypoint without lifecycle execution or a concrete malicious data flow. The remote script loads are package-aligned captcha functionality rather than a confirmed attack.
Evidence
index-BOa97Aot.js
Network endpoints2
cdn-static.gitcode.com/js/tac/load.min.jscdn-static.gitcode.com/js/yidun/yidun-captcha.js
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The complete manifest names index.js as the entrypoint and contains no lifecycle scripts or dependencies.
- The bundle dynamically loads two GitCode CDN captcha SDKs when its captcha loader is invoked; no credential harvesting, shell execution, or install-time behavior was found in the inspected entry path.
Evidence against
- The browser bundle injects remote captcha scripts without an integrity attribute, creating ordinary third-party CDN trust exposure.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedindex-BOa97Aot.jsView file
8336patternName = generic_password
severity = medium
line = 8336
Medium
4503const { code: code2, detectError } = baseCompile(message, context);
L4504: const msg = new Function(`return ${code2}`)();
L4505: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-BOa97Aot.jsView on unpkg · L450326244loadScriptElement(_retryCount, resolve, reject) {
const script = document.createElement("script");
script.type = "text/javascript";
script.src = "https://cdn-static.gitcode.com/js/tac/load.min.js"
Low
Ai Review Evidence
The bundle dynamically loads two GitCode CDN captcha SDKs when its captcha loader is invoked; no credential harvesting, shell execution, or install-time behavior was found in the inspected entry path.
index-BOa97Aot.jsView on unpkg · L26244Findings
3 Medium7 Low
MediumSecret Patternindex-BOa97Aot.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-BOa97Aot.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex-BOa97Aot.js
LowAi Review Evidenceindex-BOa97Aot.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.36.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.