registry / vue-layout-gitcode / 1.12.71

vue-layout-gitcode@1.12.71

用于 gitcode 站点生产环境使用

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The flagged primitives resolve to package-aligned site behavior: API requests target GitCode’s configured host, and support contact fields go to the GitCode-branded support integration. The dynamic Function call is part of the i18n compiler, whose JIT setting defaults to off; no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumers import the exported UI components; no package lifecycle trigger is defined.

Impact

No evidence shows credentials being sent to an unrelated recipient, destructive behavior, or unauthorized code execution.

Mechanism

The bundle uses the configured GitCode API, initializes its branded support integration, and includes a standard message compiler.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies this as a GitCode site package and defines no lifecycle scripts.
index.js imports and re-exports components from index-V0acCNJL.js.
The bundle configures its API client for web-api.gitcode.com; saved access tokens are attached to that client’s requests.
The bundle initializes a GitCode-branded Udesk support integration and passes it locally stored customer contact fields when the support item is shown.
The bundle defaults Vue i18n JIT compilation to off; its new Function call is in the i18n message compiler.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 1.41 MB of source, external domains: activity.gitcode.com, ai.gitcode.com, atomcode.atomgit.com, atomgit.com, beian.miit.gov.cn, beian.mps.gov.cn, cdn-static.gitcode.com, competition.gitcode, competition.gitcode.com, docs.atomgit.com, docs.gitcode.com, gitcode-img.obs.cn-south-1.myhuaweicloud.com, gitcode-layout.invalid, gitcode.com, gitcode.s2.udesk.cn, news.gitcode.com, pre-news.atomgit.com, pre-news.gitcode.com, test-news.atomgit.com, test-news.gitcode.net, test.gitcode.net, tianqi.gitcode.com, tinyurl.com, vue-i18n.intlify.dev, web-api.gitcode.com, www.csdn.net, www.huaweicloud.com, www.w3.org, www.zhipin.com

Source & flagged code

7 flagged

index-V0acCNJL.jsView file

9414patternName = generic_password severity = medium line = 9414

Medium

Secret Pattern

Package contains a possible secret pattern.

index-V0acCNJL.jsView on unpkg · L9414

5426const { code: code2, detectError } = baseCompile(message, context); L5427: const msg = new Function(`return ${code2}`)(); L5428: return !detectError ? compileCache[cacheKey] = msg : msg;

Low

Eval

Package source references a known benign dynamic code generation pattern.

index-V0acCNJL.jsView on unpkg · L5426

58VITE_HOST: "https://gitcode.com", VITE_HOST_TIANQI: "https://tianqi.gitcode.com", VITE_API_HOST: "https://web-api.gitcode.com", VITE_AD_LINK: "https://cdn-static.gitcode.com/adList/active.json

Low

Ai Review Evidence

The bundle configures its API client for web-api.gitcode.com; saved access tokens are attached to that client’s requests.

index-V0acCNJL.jsView on unpkg · L58

Findings

3 Medium9 Low

MediumSecret Patternindex-V0acCNJL.js

MediumNetwork

MediumEnvironment Vars

LowEvalindex-V0acCNJL.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceindex.js

LowAi Review Evidenceindex-V0acCNJL.js

Affected versions and remediation

This report applies to vue-layout-gitcode@1.12.71.

See all versions of vue-layout-gitcode for other recorded verdicts.

Review the evidence and your use of vue-layout-gitcode@1.12.71 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 15:04:27.505Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / vue-layout-gitcode / 1.12.71

vue-layout-gitcode@1.12.71

用于 gitcode 站点生产环境使用

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

Consumers import the exported UI components; no package lifecycle trigger is defined.

Impact

No evidence shows credentials being sent to an unrelated recipient, destructive behavior, or unauthorized code execution.

Mechanism

The bundle uses the configured GitCode API, initializes its branded support integration, and includes a standard message compiler.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies this as a GitCode site package and defines no lifecycle scripts.
index.js imports and re-exports components from index-V0acCNJL.js.
The bundle configures its API client for web-api.gitcode.com; saved access tokens are attached to that client’s requests.
The bundle initializes a GitCode-branded Udesk support integration and passes it locally stored customer contact fields when the support item is shown.
The bundle defaults Vue i18n JIT compilation to off; its new Function call is in the i18n message compiler.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

index-V0acCNJL.jsView file

9414patternName = generic_password severity = medium line = 9414

Medium

Secret Pattern

Package contains a possible secret pattern.

index-V0acCNJL.jsView on unpkg · L9414

5426const { code: code2, detectError } = baseCompile(message, context); L5427: const msg = new Function(`return ${code2}`)(); L5428: return !detectError ? compileCache[cacheKey] = msg : msg;

Low

Eval

Package source references a known benign dynamic code generation pattern.

index-V0acCNJL.jsView on unpkg · L5426

58VITE_HOST: "https://gitcode.com", VITE_HOST_TIANQI: "https://tianqi.gitcode.com", VITE_API_HOST: "https://web-api.gitcode.com", VITE_AD_LINK: "https://cdn-static.gitcode.com/adList/active.json

Low

Ai Review Evidence

The bundle configures its API client for web-api.gitcode.com; saved access tokens are attached to that client’s requests.

index-V0acCNJL.jsView on unpkg · L58

Findings

3 Medium9 Low

MediumSecret Patternindex-V0acCNJL.js

MediumNetwork

MediumEnvironment Vars

LowEvalindex-V0acCNJL.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceindex.js

LowAi Review Evidenceindex-V0acCNJL.js

Affected versions and remediation

This report applies to vue-layout-gitcode@1.12.71.

See all versions of vue-layout-gitcode for other recorded verdicts.

Review the evidence and your use of vue-layout-gitcode@1.12.71 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 15:04:27.505Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.