registry / vue-layout-gitcode / 1.12.74
vue-layout-gitcode@1.12.74
用于 gitcode 站点生产环境使用
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest has no lifecycle hooks, and the inspected bundle uses GitCode-aligned endpoints for API and login behavior. The flagged dynamic code generation is part of localization message compilation; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer imports the package and invokes its exported site components or helpers.
Impact
No malicious impact was established from the inspected source.
Mechanism
The bundle uses GitCode’s configured API host for authenticated requests and compiles generated localization messages at runtime.
AI rationale
The manifest has no lifecycle hooks, and the inspected bundle uses GitCode-aligned endpoints for API and login behavior. The flagged dynamic code generation is part of localization message compilation; no concrete attack behavior was found.
Evidence
package.jsonindex.jsindex-Cf2-Chx2.js
Network endpoints2
web-api.gitcode.comcdn-static.gitcode.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies index.js as the entry point and defines no lifecycle scripts.
- The bundle’s default API and ad hosts are web-api.gitcode.com and cdn-static.gitcode.com.
- Authenticated API requests use the configured GitCode API host; the stored access token is added as a bearer token to those requests.
- The password login helper encrypts caller-provided password data and posts it to the user OAuth login endpoint.
- The dynamic Function call compiles generated localization message code, and the migration configuration is fetched from a same-origin path.
Evidence against
- The package manifest shows no install-time execution hook.
- The inspected network and credential handling is consistent with the package’s GitCode site purpose.
- The dynamic code generation occurs after compiling a localization message, rather than loading an external payload.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
Source & flagged code
7 flaggedindex-Cf2-Chx2.jsView file
9414patternName = generic_password
severity = medium
line = 9414
Medium
5426const { code: code2, detectError } = baseCompile(message, context);
L5427: const msg = new Function(`return ${code2}`)();
L5428: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-Cf2-Chx2.jsView on unpkg · L542655css";
const defaultConfig = {
VITE_ENV: "production",
VITE_HOST: "https://gitcode.com",
VITE_HOST_TIANQI: "https://tianqi.gitcode.com",
VITE_API_HOST: "https://web-api.gitcode.com",
VITE_AD_LINK: "https://cdn-static.gitcode.com/adList/active.json",
VITE_NEWS_HOST: "https://news.gitcode.com",
VITE_AI_HOST: "https://ai.gitcode.com",
VITE_INCUBATION_TOPIC: "6656c64efd46e722f6299761",
VITE_GSTAR_TOPIC: "6656c65ebacc215dac8b2d06",
VITE_TRUSTED_TOPIC: "6716255303226504db66d8d7",
VITE_SEARC
Low
Ai Review Evidence
The bundle’s default API and ad hosts are web-api.gitcode.com and cdn-static.gitcode.com.
Findings
3 Medium9 Low
MediumSecret Patternindex-Cf2-Chx2.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-Cf2-Chx2.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex-Cf2-Chx2.js
LowAi Review Evidenceindex-Cf2-Chx2.js
LowAi Review Evidenceindex-Cf2-Chx2.js
LowAi Review Evidenceindex-Cf2-Chx2.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.74.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.