registry / vue-layout-gitcode / 1.12.49
vue-layout-gitcode@1.12.49
用于 gitcode 站点生产环境使用
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe manifest contains no lifecycle hook, and the inspected entry point is a component re-export. The observed network configuration is package-aligned and no concrete malicious behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package exposes its layout component exports.
Impact
No install-time mutation, credential harvesting, shell execution, or confirmed exfiltration was identified.
Mechanism
The entry module re-exports bundled user-interface components; network configuration targets GitCode services.
AI rationale
The manifest contains no lifecycle hook, and the inspected entry point is a component re-export. The observed network configuration is package-aligned and no concrete malicious behavior was found.
Network endpoints2
web-api.gitcode.comgitcode.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts and declares index.js as its entry point.
- The entry point re-exports layout components from the bundled module.
- The bundled client uses GitCode service defaults for its API configuration.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedindex-C9L7Er3e.jsView file
8291patternName = generic_password
severity = medium
line = 8291
Medium
4445const { code: code2, detectError } = baseCompile(message, context);
L4446: const msg = new Function(`return ${code2}`)();
L4447: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-C9L7Er3e.jsView on unpkg · L444556const defaultConfig = {
VITE_ENV: "production",
VITE_HOST: "https://gitcode.com",
VITE_HOST_TIANQI: "https://tianqi.gitcode.com",
VITE_API_HOST: "https://web-api.gitcode.com",
VITE_AD_LINK: "https://cdn-static.
Low
Ai Review Evidence
The bundled client uses GitCode service defaults for its API configuration.
index-C9L7Er3e.jsView on unpkg · L56Findings
3 Medium7 Low
MediumSecret Patternindex-C9L7Er3e.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-C9L7Er3e.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex-C9L7Er3e.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.49.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.