registry / vue-spear-tip / 0.6.23

vue-spear-tip@0.6.23

Vue 3 TypeScript Class Components with @Watch, Computed (as getter), @Prop decorators. And UI KIT on them.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a Vue component library with user-invoked file upload/download helpers and editor/UI bundles.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing the library or using its Vue components in an application

Impact

No evidence of unauthorized code execution, exfiltration, persistence, or install-time mutation

Mechanism

Benign component runtime behavior with user-supplied URLs/props

Rationale

Static inspection found suspicious primitives, but they are package-aligned UI features or bundled library patterns and not an attack chain. There are no lifecycle hooks, hardcoded exfiltration endpoints, credential/file harvesting, destructive behavior, or AI-agent control-surface mutations.

Evidence

package.jsondist/vue-spear-tip.es.jsdist/vue-spear-tip.cjs.jsdist/index-eB9aVRVz.jsdist/index-DqJyjsnu.cjsdist/FilesArea-C6qxxQ4b.jsdocs/static/FilesArea-Bq8CEzEr.jsdist/TextField-C31yAHWi.jsdist/SelectField-BeJiyeJh.cjs

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index-DqJyjsnu.cjs has VSTLib.onVariableCreated using eval on a validated variable-name string
dist/FilesArea-C6qxxQ4b.js and docs/static/FilesArea-Bq8CEzEr.js perform fetch/XHR for file upload/download using component props such as uploadPath/uri
dist/index-eB9aVRVz.js dynamically imports component chunks including TextField/FilesArea/SelectField

Evidence against

package.json has no preinstall/install/postinstall hooks or bin entries
Entrypoints dist/vue-spear-tip.es.js and dist/vue-spear-tip.cjs.js only re-export Vue components/helpers from bundled dist files
No child_process, fs writes, credential harvesting, AI-agent config writes, native binaries, or persistence found in inspected package files
Network use is user-invoked UI behavior for file upload/download/viewing, with no hardcoded exfiltration endpoint
Bidi-control check of scanner-hot files returned no Trojan Source control characters
Scanner eval/network hits align with bundled libraries or explicit component functionality

Behavioral surface

Source

ChildProcessCryptoEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 8.11 MB of source, external domains: bun.com, developer.mozilla.org, github.com, nodejs.org, prosemirror.net, pugjs.org, sass-lang.com, stuk.github.io, tailwindcss.com, unocss.dev, vite.dev, w3c.github.io, www.npmjs.com, www.typescriptlang.org, www.w3.org

Source & flagged code

3 flagged

docs/static/FilesArea-Bq8CEzEr.jsView file

Lines 1-23javascript

1var Tt=Object.defineProperty;var b=(s,l)=>Tt(s,"name",{value:l,configurable:!0});import{K as Ge,G as vt,P as se,C as gt,h as De,o as J,c as ne,n as xe,l as Te,I as Pe,a as F,H as ye,w as ge,e as Fe,t as ve,b as ke,f as be,i as Pt,g as Re,m as Ct,L as pt,D as Ft,j as yt,A as Ce,M as tt,u as nt,J as Ne,N as _t,O as lt,r as et,W as Et,E as Rt,F as Mt,Q as Ut,k as xt}from"./main-tTd6Si7U.js";import{F as jt}from"./FieldComponent.vue_vue_type_script_lang-DxdSyAFQ.js";import{c as Qe,g as $t,a as Lt}from"./_commonjsHelpers-BO6-jdEg.js";var Zt=Object.defineProperty,Ht=Object.getOwnPropertyDescriptor,Oe ...

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(l)}" type="application/pdf">

11 </body>

12 </html>

13 `,a=new Blob([k],{type:"text/html"});this.pdfUrl=URL.createObjectURL(a)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Ze,"PdfViewer"),Ze);ht([se(String)],Ke.prototype,"uri",2);ht([se(String)],Ke.prototype,"ext",2);ht([se(String)],Ke.prototype,"fileName",2);Ke=ht([lt],Ke);const ar={class:"pdf-container h100vh w-full fixed l-0 t-50px bg-white p-0"},or={key:0,class:"absolute t-0 l-0 bg-white/80 text-lightblue-600 flex items-center justify-center w100% h100%"},lr={key:1,class:"bg-white h[calc(100vh-50px)] w100vw fixed p-0"},dr=["src"];function hr(s,l,d,k,a,o ...

14\0`,q+=o(P,2),q+=L.magic,q+=o(E,2),q+=o(D,2),q+=o(ee.crc32,4),q+=o(ee.compressedSize,4),q+=o(ee.uncompressedSize,4),q+=o(W.length,2),q+=o(u.length,2),{fileRecord:_.LOCAL_FILE_HEADER+q+W+u,dirRecord:_.CENTRAL_FILE_HEADER+o(ie,2)+q+o(te.length,2)+"\0\0\0\0"+o(N,4)+o(w,4)+W+u+te}}b(r,"n");var i=d("../utils"),p=d("../stream/GenericWorker"),g=d("../utf8"),x=d("../crc32"),_=d("../signature");function C(f,m,h,w){p.call(

15 <br><div class="text-center"><b>• ${p.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/FilesArea-Bq8CEzEr.jsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

17 <b>.jpeg .jpg .png .svg .svgz .gif .bmp .webp .avif .apng .webp .jfif, .pgp</b></div>`},"warning"),g.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены:</div>

18 <br><div class="text-center"><b>• ${g.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

20 </div>`},"warning"),x.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены, потому что максимальный размер

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

22 <br><div class="text-center"><b>• ${x.join("</b><br><b>• ")}</b><br><br></div>`},"warning"),!k.has("files[]")){const m=Object.keys(o).length;m&&this.errorHandler?.({title:"Ошибка",message:`Так${m==1?"ой":"ие"} файл${m==1?"":"ы"} уже есть`}),this.onUploadInProcess=!1;return}const _=new XMLHttpRequest,C=this.uploadPath;_.open("POST",C,!0);let f={};this.uploadHeaders&&(typeof this.uploadHeaders=="function"?f=this.uploadHeaders():f=this.uploadHeaders);for(const m in f)_.setRequestHeader(m,f[m]);_.upload.addEventListener("progress",m=>{if

Long lines were clipped for display.

dist/TextField-C31yAHWi.jsView file

1585contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TextField-C31yAHWi.jsView on unpkg · L1585

dist/SelectField-BeJiyeJh.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-DqJyjsnu.cjs -> dist/SelectField-BeJiyeJh.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-BeJiyeJh.cjsView on unpkg

Source & flagged code

3 flagged · loading source

docs/static/FilesArea-Bq8CEzEr.jsView file

13`,a=new Blob([k],{type:"text/html"});this.pdfUrl=URL.createObjectURL(a)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Ze,"PdfViewer"),Ze);ht([se... L14: \0`,q+=o(P,2),q+=L.magic,q+=o(E,2),q+=o(D,2),q+=o(ee.crc32,4),q+=o(ee.compressedSize,4),q+=o(ee.uncompressedSize,4),q+=o(W.length,2),q+=o(u.length,2),{fileRecord:_.LOCAL_FILE_HEADE... L15: <br><div class="text-center"><b>• ${p.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/FilesArea-Bq8CEzEr.jsView on unpkg · L13

dist/TextField-C31yAHWi.jsView file

1585contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TextField-C31yAHWi.jsView on unpkg · L1585

dist/SelectField-BeJiyeJh.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-DqJyjsnu.cjs -> dist/SelectField-BeJiyeJh.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-BeJiyeJh.cjsView on unpkg

Findings

2 Critical2 Medium6 Low

CriticalTrojan Source Unicodedist/TextField-C31yAHWi.js

CriticalTrigger Reachable Dangerous Capabilitydist/SelectField-BeJiyeJh.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldocs/static/FilesArea-Bq8CEzEr.js

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

docs/static/FilesArea-Bq8CEzEr.jsView file

Lines 1-23javascript

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(l)}" type="application/pdf">

11 </body>

12 </html>

15 <br><div class="text-center"><b>• ${p.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/FilesArea-Bq8CEzEr.jsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

18 <br><div class="text-center"><b>• ${g.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

Long lines were clipped for display.

dist/TextField-C31yAHWi.jsView file

1585contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TextField-C31yAHWi.jsView on unpkg · L1585

dist/SelectField-BeJiyeJh.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-DqJyjsnu.cjs -> dist/SelectField-BeJiyeJh.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-BeJiyeJh.cjsView on unpkg