registry / vue-layout-gitcode / 1.12.48
vue-layout-gitcode@1.12.48
用于 gitcode 站点生产环境使用
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no malicious behavior. The only remote code loading is package-aligned captcha functionality used by the browser login UI.
Static reason
One or more suspicious static signals were detected.
Trigger
Normal application import and user login interactions.
Impact
No install-time mutation, credential harvesting, shell execution, or unconsented external attack behavior was found.
Mechanism
The code exports UI components and conditionally loads GitCode-hosted captcha SDKs.
AI rationale
Static inspection found no malicious behavior. The only remote code loading is package-aligned captcha functionality used by the browser login UI.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package metadata defines a browser module entry and contains no lifecycle hook or dependency declarations.
- The entry module only re-exports internal layout, login, and UI components.
- The bundle selects a captcha provider from an API response for the login flow.
- Captcha SDK scripts are loaded from the GitCode static CDN and checked for their expected browser APIs.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-DeGDfCYb.jsView file
8291patternName = generic_password
severity = medium
line = 8291
Medium
4445const { code: code2, detectError } = baseCompile(message, context);
L4446: const msg = new Function(`return ${code2}`)();
L4447: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-DeGDfCYb.jsView on unpkg · L444527582const getCurrentCaptchaType = async () => {
var _a;
const res = await API.getCaptchaType();
if (!res.error) {
captchaType.value = ((_a = res == null ? void 0 : res.data) == null ? void 0 : _a.data) || { provider: "SELF" };
switch (captchaType.value.provider) {
case "SELF":
captchaLocalMode.value = "tianai";
break;
case "YUNPIAN":
captchaLocalMode.value = "yunpian";
break;
Low
Ai Review Evidence
The bundle selects a captcha provider from an API response for the login flow.
index-DeGDfCYb.jsFindings
3 Medium9 Low
MediumSecret Patternindex-DeGDfCYb.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-DeGDfCYb.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex-DeGDfCYb.js
LowAi Review Evidenceindex-DeGDfCYb.js
LowAi Review Evidenceindex-DJYL3DkE.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.48.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.48 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.