registry / vue-spear-tip / 0.6.26

vue-spear-tip@0.6.26

Vue 3 TypeScript Class Components with @Watch, Computed (as getter), @Prop decorators. And UI KIT on them.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Runtime network behavior is limited to component file upload/download features controlled by the consuming app.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User interaction with Vue components, especially FilesArea upload/download/view actions

Impact

No credential theft, persistence, remote payload execution, or install-time mutation identified

Mechanism

Package-aligned frontend component behavior

Rationale

Static source inspection shows a Vue component library with bundled UI dependencies and user-driven upload/download code, not install-time or import-time attack behavior. Scanner findings appear to be noisy matches on browser APIs, bundled libraries, and minified artifacts.

Evidence

package.jsondist/vue-spear-tip.cjs.jsdist/vue-spear-tip.es.jsdist/FilesArea-DvLk50rV.jsdist/FilesArea-DY0W_C4Z.cjsdocs/static/FilesArea-DH7ifHSz.jsdist/SelectField-BEhDHa74.jsdist/SelectField-Ce-ksjur.cjs

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks; scripts are dev/build only.
Entrypoints dist/vue-spear-tip.cjs.js and dist/vue-spear-tip.es.js only re-export Vue components/helpers.
dist/FilesArea-DvLk50rV.js network use is user-invoked file upload/download via props uploadPath, uploadHeaders, and file.uri.
No source evidence of child_process, fs access, credential/env harvesting, persistence, or AI-agent control-surface writes.
Scanner unicode/control-character hits align with bundled/minified JSZip/binary-signature strings, not hidden control flow.
SelectField files implement bundled Tagify/select UI behavior; timeout/hook code is UI event handling.

Behavioral surface

Source

ChildProcessCryptoEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 8.12 MB of source, external domains: bun.com, developer.mozilla.org, github.com, nodejs.org, prosemirror.net, pugjs.org, sass-lang.com, stuk.github.io, tailwindcss.com, unocss.dev, vite.dev, w3c.github.io, www.npmjs.com, www.typescriptlang.org, www.w3.org

Source & flagged code

3 flagged

docs/static/FilesArea-DH7ifHSz.jsView file

Lines 1-23javascript

1var Tt=Object.defineProperty;var b=(s,l)=>Tt(s,"name",{value:l,configurable:!0});import{K as Ge,G as vt,P as se,C as gt,h as De,o as J,c as ne,n as xe,l as Te,I as Pe,a as F,H as ye,w as ge,e as Fe,t as ve,b as ke,f as be,i as Pt,g as Re,m as Ct,L as pt,D as Ft,j as yt,A as Ce,M as tt,u as nt,J as Ne,N as _t,O as lt,r as et,W as Et,E as Rt,F as Mt,Q as Ut,k as xt}from"./main-lc-ptAxQ.js";import{F as jt}from"./FieldComponent.vue_vue_type_script_lang-wHI6nnp6.js";import{c as Qe,g as $t,a as Lt}from"./_commonjsHelpers-BO6-jdEg.js";var Zt=Object.defineProperty,Ht=Object.getOwnPropertyDescriptor,Oe ...

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(l)}" type="application/pdf">

11 </body>

12 </html>

13 `,a=new Blob([k],{type:"text/html"});this.pdfUrl=URL.createObjectURL(a)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Ze,"PdfViewer"),Ze);ht([se(String)],Ke.prototype,"uri",2);ht([se(String)],Ke.prototype,"ext",2);ht([se(String)],Ke.prototype,"fileName",2);Ke=ht([lt],Ke);const ar={class:"pdf-container h100vh w-full fixed l-0 t-50px bg-white p-0"},or={key:0,class:"absolute t-0 l-0 bg-white/80 text-lightblue-600 flex items-center justify-center w100% h100%"},lr={key:1,class:"bg-white h[calc(100vh-50px)] w100vw fixed p-0"},dr=["src"];function hr(s,l,d,k,a,o ...

14\0`,q+=o(P,2),q+=L.magic,q+=o(E,2),q+=o(D,2),q+=o(ee.crc32,4),q+=o(ee.compressedSize,4),q+=o(ee.uncompressedSize,4),q+=o(W.length,2),q+=o(u.length,2),{fileRecord:_.LOCAL_FILE_HEADER+q+W+u,dirRecord:_.CENTRAL_FILE_HEADER+o(ie,2)+q+o(te.length,2)+"\0\0\0\0"+o(N,4)+o(w,4)+W+u+te}}b(r,"n");var i=d("../utils"),p=d("../stream/GenericWorker"),g=d("../utf8"),x=d("../crc32"),_=d("../signature");function C(f,m,h,w){p.call(

15 <br><div class="text-center"><b>• ${p.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/FilesArea-DH7ifHSz.jsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

17 <b>.jpeg .jpg .png .svg .svgz .gif .bmp .webp .avif .apng .webp .jfif, .pgp</b></div>`},"warning"),g.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены:</div>

18 <br><div class="text-center"><b>• ${g.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

20 </div>`},"warning"),x.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены, потому что максимальный размер

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

22 <br><div class="text-center"><b>• ${x.join("</b><br><b>• ")}</b><br><br></div>`},"warning"),!k.has("files[]")){const m=Object.keys(o).length;m&&this.errorHandler?.({title:"Ошибка",message:`Так${m==1?"ой":"ие"} файл${m==1?"":"ы"} уже есть`}),this.onUploadInProcess=!1;return}const _=new XMLHttpRequest,C=this.uploadPath;_.open("POST",C,!0);let f={};this.uploadHeaders&&(typeof this.uploadHeaders=="function"?f=this.uploadHeaders():f=this.uploadHeaders);for(const m in f)_.setRequestHeader(m,f[m]);_.upload.addEventListener("progress",m=>{if

Long lines were clipped for display.

dist/SelectField-BEhDHa74.jsView file

Lines 926-966javascript

926}, "onEditTagkeydown"), onDoubleClickScope: /* @__PURE__ */ r(function(t) {

927 if (t.target) {

928 var e = t.target.closest("." + this.settings.classNames.tag);

929 if (e) {

dist/SelectField-Ce-ksjur.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-Dxo3fKNO.cjs -> dist/SelectField-Ce-ksjur.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-Ce-ksjur.cjsView on unpkg

Source & flagged code

3 flagged · loading source

docs/static/FilesArea-DH7ifHSz.jsView file

13`,a=new Blob([k],{type:"text/html"});this.pdfUrl=URL.createObjectURL(a)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Ze,"PdfViewer"),Ze);ht([se... L14: \0`,q+=o(P,2),q+=L.magic,q+=o(E,2),q+=o(D,2),q+=o(ee.crc32,4),q+=o(ee.compressedSize,4),q+=o(ee.uncompressedSize,4),q+=o(W.length,2),q+=o(u.length,2),{fileRecord:_.LOCAL_FILE_HEADE... L15: <br><div class="text-center"><b>• ${p.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/FilesArea-DH7ifHSz.jsView on unpkg · L13

dist/SelectField-BEhDHa74.jsView file

946contains invisible/control Unicode U+200B (zero width space) <U+200B>`);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/SelectField-BEhDHa74.jsView on unpkg · L946

dist/SelectField-Ce-ksjur.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-Dxo3fKNO.cjs -> dist/SelectField-Ce-ksjur.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-Ce-ksjur.cjsView on unpkg

Findings

2 Critical2 Medium6 Low

CriticalTrojan Source Unicodedist/SelectField-BEhDHa74.js

CriticalTrigger Reachable Dangerous Capabilitydist/SelectField-Ce-ksjur.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldocs/static/FilesArea-DH7ifHSz.js

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

docs/static/FilesArea-DH7ifHSz.jsView file

Lines 1-23javascript

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(l)}" type="application/pdf">

11 </body>

12 </html>

15 <br><div class="text-center"><b>• ${p.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/FilesArea-DH7ifHSz.jsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

18 <br><div class="text-center"><b>• ${g.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

Long lines were clipped for display.

dist/SelectField-BEhDHa74.jsView file

Lines 926-966javascript

926}, "onEditTagkeydown"), onDoubleClickScope: /* @__PURE__ */ r(function(t) {

927 if (t.target) {

928 var e = t.target.closest("." + this.settings.classNames.tag);

929 if (e) {

dist/SelectField-Ce-ksjur.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-Dxo3fKNO.cjs -> dist/SelectField-Ce-ksjur.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-Ce-ksjur.cjsView on unpkg