registry / vue-layout-gitcode / 1.12.46
vue-layout-gitcode@1.12.46
用于 gitcode 站点生产环境使用
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle execution or concrete malicious behavior. The observed requests are package-aligned browser configuration and a same-origin internal fetch.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package loads exported layout components; no install hook is declared.
Impact
No confirmed credential exfiltration, persistence, command execution, or destructive behavior was found.
Mechanism
The inspected network call requests a same-origin route using GET and same-origin credentials.
AI rationale
Static inspection found no lifecycle execution or concrete malicious behavior. The observed requests are package-aligned browser configuration and a same-origin internal fetch.
Network endpoints3
web-api.gitcode.comcdn-static.gitcode.com/adList/active.json/__internal/migrated-routes.json
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares only a JavaScript entry point and no lifecycle scripts.
- The entry point imports the bundled layout module and exports UI components.
- The bundle's configured service hosts are GitCode hosts.
- One direct fetch uses a same-origin internal route with GET and same-origin credentials.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
6 flaggedindex-mlmVS3BC.jsView file
8291patternName = generic_password
severity = medium
line = 8291
Medium
4445const { code: code2, detectError } = baseCompile(message, context);
L4446: const msg = new Function(`return ${code2}`)();
L4447: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-mlmVS3BC.jsView on unpkg · L444559TIANQI: "https://tianqi.gitcode.com",
VITE_API_HOST: "https://web-api.gitcode.com",
VITE_AD_LINK: "https://cdn-static.gitcode.com/adList/active.json",
VITE_NEWS_HOST: "https://news.gitcode.com",
VITE_AI_HOST: "https://ai.gitcode.com",
VITE_INCUBATION_TOPIC: "6656c64efd46e722f6299761",
VI
Low
Ai Review Evidence
The bundle's configured service hosts are GitCode hosts.
index-mlmVS3BC.jsView on unpkg · L59Findings
3 Medium8 Low
MediumSecret Patternindex-mlmVS3BC.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-mlmVS3BC.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex-mlmVS3BC.js
LowAi Review Evidenceindex-mlmVS3BC.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.46.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.