registry / vue-layout-gitcode / 1.12.77
vue-layout-gitcode@1.12.77
用于 gitcode 站点生产环境使用
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts, and the bundled request and login behavior is directed to configured GitCode services. The flagged dynamic-code pattern occurs in a message compilation path, with no separate attack behavior identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A consuming application imports the package; login requests occur when the application invokes the login helper.
Impact
No unrelated credential recipient, install-time mutation, or other confirmed attack impact was found.
Mechanism
The bundle sends requests through its configured GitCode API client and encrypts the password for the GitCode login route. Dynamic code generation follows message compilation.
AI rationale
The manifest has no lifecycle scripts, and the bundled request and login behavior is directed to configured GitCode services. The flagged dynamic-code pattern occurs in a message compilation path, with no separate attack behavior identified.
Evidence
package.jsonindex.jsindex-BXmLPEgM.js
Network endpoints3
web-api.gitcode.comgitcode.comcdn-static.gitcode.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies the package entrypoint and contains no install lifecycle scripts.
- The entrypoint imports its exports from the bundled UI module.
- The bundle defaults its API and site requests to GitCode hosts.
- The HTTP client uses the configured GitCode API host and attaches saved bearer tokens to its requests.
- The login helper encrypts the submitted password and posts it to the GitCode login route.
- The dynamic code generation appears in a message compilation path after `baseCompile`.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-BXmLPEgM.jsView file
9414patternName = generic_password
severity = medium
line = 9414
Medium
5426const { code: code2, detectError } = baseCompile(message, context);
L5427: const msg = new Function(`return ${code2}`)();
L5428: return !detectError ? compileCache[cacheKey] = msg : msg;
Low
Eval
Package source references a known benign dynamic code generation pattern.
index-BXmLPEgM.jsView on unpkg · L542657VITE_ENV: "production",
VITE_HOST: "https://gitcode.com",
VITE_HOST_TIANQI: "https://tianqi.gitcode.com",
VITE_API_HOST: "https://web-api.gitcode.com",
VITE_AD_LINK: "https://cdn-static.gitcode.com/ad
Low
Ai Review Evidence
The bundle defaults its API and site requests to GitCode hosts.
index-BXmLPEgM.jsView on unpkg · L57Findings
3 Medium9 Low
MediumSecret Patternindex-BXmLPEgM.js
MediumNetwork
MediumEnvironment Vars
LowEvalindex-BXmLPEgM.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex-BXmLPEgM.js
LowAi Review Evidenceindex-BXmLPEgM.js
LowAi Review Evidenceindex-BXmLPEgM.js
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.77.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.77 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.