vue-layout-gitcode@1.12.45
用于 gitcode 站点生产环境使用
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe exported unrestricted host override and token-forwarding interceptor meet the conditional credential-exposure warning boundary. The inspected manifest contains no installation lifecycle trigger, and no confirmed covert destination was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls the exported configuration setter and then invokes an authenticated request.
Impact
A consumer-controlled host could receive a GitCode access token, creating conditional credential exposure.
Mechanism
The mutable API-host configuration is used as the axios base URL, while the request interceptor reads local storage and adds a Bearer token.
AI rationale
The exported unrestricted host override and token-forwarding interceptor meet the conditional credential-exposure warning boundary. The inspected manifest contains no installation lifecycle trigger, and no confirmed covert destination was found.
Evidence
index-mlmVS3BC.js
Network endpoints1
web-api.gitcode.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest has no lifecycle hook and declares index.js as the main entry point.
- The public entry point exports setLayoutConfig.
- setLayoutConfig accepts arbitrary configuration properties, including the API host.
- Requests use the configurable API host and attach the stored access token as a Bearer authorization header.
Evidence against
- The default API host is the package-aligned web-api.gitcode.com endpoint.
- No install-time execution, shell execution, or confirmed hidden export was found.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-mlmVS3BC.jsView file
8291patternName = generic_password
severity = medium
line = 8291
Medium
71const layoutConfig$7 = reactive({ ...defaultConfig });
function setLayoutConfig(customConfig) {
Object.assign(layoutConfig$7, customConfig);
}
function u
Medium
Ai Review Evidence
setLayoutConfig accepts arbitrary configuration properties, including the API host.
index-mlmVS3BC.jsView on unpkg · L718856const proxyService = (params, customConfigs) => {
const service = axios.create({
baseURL: layoutConfig$5.VITE_API_HOST,
timeout: (customConfigs == null ? void 0 : customConfigs.customTimeout) || 3e4,
withCredentials: true
});
const whiteList = ["/login", "login/mobile", "/sendVeriCode", "/register", "/quickLogin", "/quickRegister", "/forgetCode", "/forgetPassword", "/checkSameUser", "/token"];
const notAuthorization = (url = "") => {
return whiteList.some((str) => url.includes(str));
};
service.interceptors.request.use(
(c
Medium
Stripped Provenance Metadata
Findings
8 Medium4 Low
MediumSecret Patternindex-mlmVS3BC.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex-mlmVS3BC.js
MediumStripped Provenance Metadataindex-mlmVS3BC.js
MediumStripped Provenance Metadataindex-mlmVS3BC.js
LowEvalindex-mlmVS3BC.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.45.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.