vue-layout-gitcode@1.12.82
用于 gitcode 站点生产环境使用
AI Security Review
scanned 6d ago · by lpm-firewall-aiThis is a GitCode UI library with no install hook, and its API traffic is directed to GitCode services. The bundled reporting flow sends page and event data without an evident consent check or opt-out, so classify it as suspicious runtime telemetry.
Static reason
One or more suspicious static signals were detected.
Trigger
When the UI invokes pageview or reporting helpers during use.
Impact
Usage and page context are collected without an evident consent check or opt-out in the inspected reporting flow.
Mechanism
Pageview handling forwards the pathname and query string to `_hmt`; the report helper posts event IDs and caller-supplied data to the GitCode API.
AI rationale
This is a GitCode UI library with no install hook, and its API traffic is directed to GitCode services. The bundled reporting flow sends page and event data without an evident consent check or opt-out, so classify it as suspicious runtime telemetry.
Evidence
index-D8YQtrik.js
Network endpoints1
web-api.gitcode.com/api/v1/report
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundle forwards the current page path and query string to the `_hmt` analytics client for pageview events.
- Its reporting helper posts caller-provided event data and event IDs to `/api/v1/report`.
- The reporting API uses the configured GitCode API host, `https://web-api.gitcode.com`.
- The package is described as a GitCode production-site UI library and exposes `index.js` as its main entry.
Evidence against
- The package metadata declares no install lifecycle script or executable.
- The access token is attached to requests made through the GitCode API client; no unrelated credential destination was identified.
- The configured key is used to encrypt a password in the login flow.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggedindex-D8YQtrik.jsView file
9416patternName = generic_password
severity = medium
line = 9416
Medium
204=> {
const globalStore = inject("globalStore");
if (eventID === "pageview" && window._hmt) {
const path = window.location.pathname + window.location.search;
window._hmt.push(["_trackPageview", path]);
}
if ((globa
Medium
Ai Review Evidence
The bundle forwards the current page path and query string to the `_hmt` analytics client for pageview events.
index-D8YQtrik.jsView on unpkg · L20413664report(eventId, data, headers = {}) {
return reqCatch(() => request({
url: `/api/v1/report`,
method: "post",
data,
params: {
event_id: eventId
},
headers
},
Medium
Ai Review Evidence
Its reporting helper posts caller-provided event data and event IDs to `/api/v1/report`.
index-D8YQtrik.jsView on unpkg · L13664Findings
8 Medium4 Low
MediumSecret Patternindex-D8YQtrik.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidenceindex-D8YQtrik.js
MediumAi Review Evidenceindex-D8YQtrik.js
MediumAi Review Evidenceindex-D8YQtrik.js
MediumAi Review Evidenceindex-D8YQtrik.js
MediumAi Review Evidencepackage.json
LowEvalindex-D8YQtrik.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to vue-layout-gitcode@1.12.82.
See all versions of vue-layout-gitcode for other recorded verdicts.
- Review the evidence and your use of vue-layout-gitcode@1.12.82 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.