registry / vue-layout-gitcode / 1.12.76
vue-layout-gitcode@1.12.76
用于 gitcode 站点生产环境使用
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no lifecycle hooks, and the flagged runtime behavior is consistent with a GitCode UI library: its API host is GitCode, login data is sent through the service request path, and route configuration is fetched from the same origin. The static signals do not establish a concrete attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
The library runs when imported and its exported UI features are used in a host application.
Impact
No unrelated credential transfer, install-time mutation, or other concrete attack effect was identified.
Mechanism
API requests use the configured GitCode API host; login encrypts a supplied password for that service, and route migration reads same-origin configuration.
AI rationale
The manifest has no lifecycle hooks, and the flagged runtime behavior is consistent with a GitCode UI library: its API host is GitCode, login data is sent through the service request path, and route configuration is fetched from the same origin. The static signals do not establish a concrete attack surface.
Evidence
package.jsonindex.jsindex-C6VJdLiY.js
Network endpoints2
web-api.gitcode.com/__internal/migrated-routes.json
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest names a UI library entrypoint and contains no lifecycle scripts.
- The bundle defaults its API host to web-api.gitcode.com.
- The request client uses the configured API host; password encryption supplies the GitCode login request.
- A same-origin route configuration controls whether navigation opens a migrated path.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-C6VJdLiY.jsView file
9414patternName = generic_password
severity = medium
line = 9414
Medium
5426const { code: code2, detectError } = baseCompile(message, context);
L5427: const msg = new Function(`return ${code2}`)();
L5428: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-C6VJdLiY.jsView on unpkg · L542656const defaultConfig = {
VITE_ENV: "production",
VITE_HOST: "https://gitcode.com",
VITE_HOST_TIANQI: "https://tianqi.gitcode.com",
VITE_API_HOST: "https://web-api.gitcode.com",
VITE_AD_LINK: "https://cdn-static.gitcode.com/adList/a
Low
Ai Review Evidence
The bundle defaults its API host to web-api.gitcode.com.
index-C6VJdLiY.jsView on unpkg · L56Findings
3 Medium9 Low
MediumSecret Patternindex-C6VJdLiY.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-C6VJdLiY.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex-C6VJdLiY.js
LowAi Review Evidenceindex-C6VJdLiY.js
LowAi Review Evidenceindex-C6VJdLiY.js
LowAi Review Evidenceindex-C6VJdLiY.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.76.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.