registry / vue-layout-gitcode / 1.12.66
vue-layout-gitcode@1.12.66
用于 gitcode 站点生产环境使用
AI Security Review
scanned 16d ago · by lpm-firewall-aiSource inspection found no lifecycle hook and no concrete attack behavior. The network and dynamic-code signals are explained by the package’s GitCode UI, authentication client, and Vue i18n compiler.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumers import the package entrypoint and use its exported UI components or helpers.
Impact
No concrete harmful effect was established from these behaviors.
Mechanism
The bundle makes API requests to the configured GitCode API host and performs a same-origin configuration fetch; the inspected dynamic code generation belongs to the Vue i18n compiler.
AI rationale
Source inspection found no lifecycle hook and no concrete attack behavior. The network and dynamic-code signals are explained by the package’s GitCode UI, authentication client, and Vue i18n compiler.
Evidence
package.jsonindex.jsindex-9brWW1pC.js
Network endpoints2
web-api.gitcode.com/__internal/migrated-routes.json
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no lifecycle scripts and points to index.js.
- index.js re-exports the compiled UI bundle.
- The bundle’s API client uses web-api.gitcode.com; it adds a stored access token to API requests outside its authentication-path exclusions.
- A separate configuration fetch uses a same-origin GET and sends no stored token in its request options.
- The dynamic function construction is part of the Vue i18n message compiler.
Evidence against
- The bundle handles browser storage and network requests, but the inspected flows are consistent with the GitCode UI and authentication client; they do not establish an unrelated credential recipient or concrete attack.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-9brWW1pC.jsView file
9406patternName = generic_password
severity = medium
line = 9406
Medium
5418const { code: code2, detectError } = baseCompile(message, context);
L5419: const msg = new Function(`return ${code2}`)();
L5420: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-9brWW1pC.jsView on unpkg · L54189979axios.create({
baseURL: layoutConfig$5.VITE_API_HOST,
timeout: (customConfigs == null ? void 0 : customConfigs.customTimeout) || 3e4,
withCredentials: true
});
const whiteList = ["/login", "login/mobile", "/sendVeriCode", "/register", "/quickLogin", "/quickRegister", "/forgetCode", "/forgetPassword", "/checkSameUser", "/token"];
const notAuthorization = (url = "") => {
return whiteList.some((str) => url.includes(str));
};
service.interceptors.request.use(
(config2) => {
var _a, _b;
const access_token = localStora
Low
Ai Review Evidence
The bundle’s API client uses web-api.gitcode.com; it adds a stored access token to API requests outside its authentication-path exclusions.
Findings
3 Medium9 Low
MediumSecret Patternindex-9brWW1pC.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-9brWW1pC.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex-9brWW1pC.js
LowAi Review Evidenceindex-9brWW1pC.js
LowAi Review Evidenceindex-9brWW1pC.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.66.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.66 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.