registry / vue-layout-gitcode / 1.12.60-multiple-account
vue-layout-gitcode@1.12.60-multiple-account
用于 gitcode 站点生产环境使用
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the suspicious static signals resolve to application configuration, authentication, and public ad retrieval. Source inspection found no concrete attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
The package exports its UI components for use by an application.
Impact
No malicious impact was established.
Mechanism
Inspected network and credential handling supports GitCode application functions; no unrelated credential transfer or other concrete attack behavior was found.
AI rationale
The manifest has no install lifecycle hook, and the suspicious static signals resolve to application configuration, authentication, and public ad retrieval. Source inspection found no concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies index.js as the entrypoint and defines no lifecycle scripts.
- The bundle configures GitCode application and API hosts.
- Saved access tokens are attached to requests made through the configured API client.
- Password login encrypts the password and sends it to the application login route.
- The external fetch retrieves the configured public ad list; no attack behavior was identified.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-Cv1-5J76.jsView file
9251patternName = generic_password
severity = medium
line = 9251
Medium
5378const { code: code2, detectError } = baseCompile(message, context);
L5379: const msg = new Function(`return ${code2}`)();
L5380: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-Cv1-5J76.jsView on unpkg · L537857VITE_ENV: "production",
VITE_HOST: "https://gitcode.com",
VITE_HOST_TIANQI: "https://tianqi.gitcode.com",
VITE_API_HOST: "https://web-api.gitcode.com",
VITE_AD_LINK: "https://cdn-static.gitcode.com/adList/active.
Low
Ai Review Evidence
The bundle configures GitCode application and API hosts.
index-Cv1-5J76.jsView on unpkg · L57Findings
3 Medium9 Low
MediumSecret Patternindex-Cv1-5J76.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-Cv1-5J76.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex-Cv1-5J76.js
LowAi Review Evidenceindex-Cv1-5J76.js
LowAi Review Evidenceindex-Cv1-5J76.js
LowAi Review Evidenceindex-Cv1-5J76.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.60-multiple-account.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.60-multiple-account before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.