vue-layout-gitcode@1.12.51
用于 gitcode 站点生产环境使用
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource shows an active login path that conditionally exposes credentials to an unrestricted parent origin. This warrants a warning for credential exposure, rather than a malware publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
Successful login while the consuming application is embedded in another origin's frame.
Impact
An embedding parent could receive session credentials if deployment protections permit framing and login completes.
Mechanism
The shared login handler posts access and refresh tokens to window.parent using a wildcard target origin.
AI rationale
Source shows an active login path that conditionally exposes credentials to an unrestricted parent origin. This warrants a warning for credential exposure, rather than a malware publication block.
Evidence
index-0hlnvutU.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published entrypoint exports the Login component.
- Successful mobile login passes the service response to the shared login handler.
- The login handler forwards access and refresh tokens to the parent window.
- The parent-window message uses a wildcard destination without an origin restriction.
Evidence against
- package.json has no install lifecycle hooks or runtime self-dependency.
- No package-controlled malicious recipient or deliberate theft was established.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-0hlnvutU.jsView file
8906patternName = generic_password
severity = medium
line = 8906
Medium
22636}, country = "" } = param;
const check = validFunc ? await validFunc() : true;
if (!check) return;
const result2 = await API.loginByMobile(loginParams);
if (!result2.error) {
const resultData = result2.data.data;
saveLoginMobile(loginParams.mobile, country);
successFunc(resultData, loginParams.mobile);
phoneAndPasswordLogin(resultData, API, LoginMethodEnum.PHONE);
Medium
Ai Review Evidence
Successful mobile login passes the service response to the shared login handler.
index-0hlnvutU.jsView on unpkg · L2263622928const params = {
access_token: userInfo.access_token,
refresh_token: userInfo.refresh_token
};
sendMessageToParent(params);
}
async function chec
Medium
Ai Review Evidence
The login handler forwards access and refresh tokens to the parent window.
index-0hlnvutU.jsView on unpkg · L22928Findings
8 Medium4 Low
MediumSecret Patternindex-0hlnvutU.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex-0hlnvutU.js
MediumAi Review Evidenceindex-0hlnvutU.js
MediumAi Review Evidenceindex-0hlnvutU.js
LowEvalindex-0hlnvutU.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.51.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.