registry / vue-layout-gitcode / 1.12.57-multiple-account
vue-layout-gitcode@1.12.57-multiple-account
用于 gitcode 站点生产环境使用
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected bundle routes authentication through GitCode’s configured API host. The flagged dynamic function construction is in the bundled message compiler; no concrete malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumers import the library and invoke its exported UI or authentication features.
Impact
No unrelated credential transfer or other confirmed attack impact was found.
Mechanism
The request client sends API requests to the configured GitCode API host; password login encrypts the caller-supplied password before posting it to the GitCode login route.
AI rationale
The manifest has no install lifecycle hook, and the inspected bundle routes authentication through GitCode’s configured API host. The flagged dynamic function construction is in the bundled message compiler; no concrete malicious behavior was identified.
Evidence
package.jsonindex.jsindex-trrN7Eu4.js
Network endpoints1
web-api.gitcode.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest names index.js as its entrypoint and contains no lifecycle script.
- The bundle defaults API traffic to GitCode service hosts.
- The request client uses the configured GitCode API host and forwards a saved token in its authorization header for requests outside its login exclusions.
- Password login encrypts the supplied password and posts it to the GitCode OAuth login route.
Evidence against
- The dynamic function construction appears in the bundled message compiler, where it compiles a message produced by the compiler.
- The inspected network and credential handling supports the library’s GitCode interface; no unrelated recipient or confirmed attack behavior was identified.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-trrN7Eu4.jsView file
9249patternName = generic_password
severity = medium
line = 9249
Medium
9820(params, customConfigs) => {
const service = axios.create({
baseURL: layoutConfig$5.VITE_API_HOST,
timeout: (customConfigs == null ? void 0 : customConfigs.customTimeout) || 3e4,
withCredentials: true
});
const whiteList = ["/login", "login/mobile", "/sendVeriCode", "/register", "/quickLogin", "/quickRegister", "/forgetCode", "/forgetPassword", "/checkSameUser", "/token"];
const notAuthorization = (url = "
Medium
Stripped Provenance Metadata
The request client uses the configured GitCode API host and forwards a saved token in its authorization header for requests outside its login exclusions.
index-trrN7Eu4.jsView on unpkg · L98209831{
var _a, _b;
const access_token = localStorage$2.getItem("access_token");
const { url } = config;
if (access_token && !notAuthorization(url)) {
config.headers.Authorization = `Bearer ${access_token}`;
}
config.headers["page-title"] = "%E9%A6%96%E9%A1%B5";
config.headers["page-ref"] = "https%3A%2F%2Ftest.gitcode.net%2F
Findings
5 Medium7 Low
MediumSecret Patternindex-trrN7Eu4.js
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadataindex-trrN7Eu4.js
MediumStripped Provenance Metadataindex-trrN7Eu4.js
LowEvalindex-trrN7Eu4.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex-trrN7Eu4.js
LowAi Review Evidenceindex-trrN7Eu4.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.57-multiple-account.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.57-multiple-account before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.