registry / vue-layout-gitcode / 1.12.75
vue-layout-gitcode@1.12.75
用于 gitcode 站点生产环境使用
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no lifecycle hook or concrete attack behavior. The flagged network and credential patterns serve GitCode-aligned UI and support functions, so the static scanner signals do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Runtime use of the exported UI components; the support widget loads when user information exists or it is opened.
Impact
No unconsented transfer to an unrelated recipient or other concrete attack behavior was established.
Mechanism
The bundle requests GitCode service resources, attaches stored credentials to its GitCode API client, and configures the GitCode support widget with profile fields.
AI rationale
Source inspection found no lifecycle hook or concrete attack behavior. The flagged network and credential patterns serve GitCode-aligned UI and support functions, so the static scanner signals do not establish malicious behavior.
Evidence
package.jsonindex.jsindex-BqIiUJGW.js
Network endpoints3
web-api.gitcode.comcdn-static.gitcode.comgitcode.s2.udesk.cn
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- The manifest declares index.js as its entrypoint and contains no lifecycle scripts; that entrypoint re-exports the bundled UI library.
- The bundle uses GitCode service hosts for its API and ad feed, and attaches a stored access token to API requests.
- The support widget reads profile fields from local storage and configures a GitCode support service; it loads when user information exists or the widget is opened.
- The ad feed is fetched from the GitCode CDN, and the migration configuration request uses same-origin credentials.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-BqIiUJGW.jsView file
9414patternName = generic_password
severity = medium
line = 9414
Medium
5426const { code: code2, detectError } = baseCompile(message, context);
L5427: const msg = new Function(`return ${code2}`)();
L5428: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-BqIiUJGW.jsView on unpkg · L542658gitcode.com",
VITE_HOST_TIANQI: "https://tianqi.gitcode.com",
VITE_API_HOST: "https://web-api.gitcode.com",
VITE_AD_LINK: "https://cdn-static.gitcode.com/adList/active.json",
VITE_NEWS_HOST: "https://news.gitcode.com",
VITE_AI_HOST: "https://ai.gitcode.com",
VITE_INCU
Low
Ai Review Evidence
The bundle uses GitCode service hosts for its API and ad feed, and attaches a stored access token to API requests.
index-BqIiUJGW.jsView on unpkg · L58Findings
3 Medium9 Low
MediumSecret Patternindex-BqIiUJGW.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-BqIiUJGW.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidenceindex.js
LowAi Review Evidenceindex-BqIiUJGW.js
LowAi Review Evidenceindex-BqIiUJGW.js
LowAi Review Evidenceindex-BqIiUJGW.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.75.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.75 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.