registry / vue-spear-tip / 0.6.31

vue-spear-tip@0.6.31

Vue 3 TypeScript Class Components with @Watch, Computed (as getter), @Prop decorators. And UI KIT on them.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime networking is an explicit file-upload component action directed to the consuming application's configured endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consuming application renders FilesArea and a user initiates file upload.

Impact

Uploads selected files to the consumer-configured server; no package-controlled endpoint, credential harvesting, persistence, or remote payload chain was found.

Mechanism

User-triggered XMLHttpRequest to configured uploadPath.

Rationale

Static inspection indicates a Vue UI component package with caller-configured file upload and browser-local component persistence. Scanner hits derive from bundled dependencies and benign UI behavior; no concrete malicious chain was found.

Evidence

package.jsondist/vue-spear-tip.es.jsdist/vue-spear-tip.cjs.jsdist/FilesArea-BU5HNYTm.jsdist/SelectField-B1Y2Fpx6.jsdist/TextField-BmyvM2dZ.jsdist/index--nWsnz6x.jsdist/index-CXxDalwu.cjsdist/FilesArea-BI-2pgWB.cjsdist/SelectField-CD7n4IhA.cjs

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with high false-positive risk.

Evidence for block

Evidence against

`package.json` has no preinstall/install/postinstall/prepare hooks.
Entrypoints only export Vue components from `dist/index--nWsnz6x.js` / `dist/index-CXxDalwu.cjs`.
`dist/FilesArea-BU5HNYTm.js` posts user-selected files only to caller-provided `uploadPath`.
`dist/SelectField-B1Y2Fpx6.js` uses localStorage solely for component state persistence.
Dynamic `Function`/`eval` matches are bundled library compatibility/global-detection code, not payload execution.
Six invisible characters in `dist/TextField-BmyvM2dZ.js` occur in editor/docs/entity data; no bidi override controls found.

Behavioral surface

Source

ChildProcessCryptoEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 8.12 MB of source, external domains: bun.com, developer.mozilla.org, github.com, nodejs.org, prosemirror.net, pugjs.org, sass-lang.com, stuk.github.io, tailwindcss.com, unocss.dev, vite.dev, w3c.github.io, www.npmjs.com, www.typescriptlang.org, www.w3.org

Source & flagged code

3 flagged

dist/FilesArea-BI-2pgWB.cjsView file

Lines 1-23javascript

1"use strict";var at=Object.defineProperty;var b=(a,d)=>at(a,"name",{value:d,configurable:!0});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const Q=require("./index-CXxDalwu.cjs"),st=require("./FieldComponent.vue_vue_type_script_lang-C8VVYHw8.cjs"),t=require("vue"),xe=require("./_commonjsHelpers-BB06FEA1.cjs");var lt=Object.defineProperty,dt=Object.getOwnPropertyDescriptor,be=b((a,d,h,E)=>{for(var s=E>1?void 0:E?dt(d,h):d,l=a.length-1,i;l>=0;l--)(i=a[l])&&(s=(E?i(d,h,s):i(s))||s);return E&&s&&lt(d,h,s),s},"__decorateClass$6"),ze;let ve=(ze=class extends Q.BaseComponent{com ...

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(d)}" type="application/pdf">

11 </body>

12 </html>

13 `,s=new Blob([E],{type:"text/html"});this.pdfUrl=URL.createObjectURL(s)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Fe,"PdfViewer"),Fe);Ze([Q.Prop(String)],Ie.prototype,"uri",2);Ze([Q.Prop(String)],Ie.prototype,"ext",2);Ze([Q.Prop(String)],Ie.prototype,"fileName",2);Ie=Ze([Q.VST],Ie);const zn={class:"pdf-container h100vh w-full fixed l-0 t-50px bg-white p-0"},Nn={key:0,class:"absolute t-0 l-0 bg-white/80 text-lightblue-600 flex items-center justify-center w100% h100%"},Cn={key:1,class:"bg-white h[calc(100vh-50px)] w100vw fixed p-0"},Sn=["src"];function ...

14\0`,q+=l(P,2),q+=$.magic,q+=l(S,2),q+=l(D,2),q+=l(ee.crc32,4),q+=l(ee.compressedSize,4),q+=l(ee.uncompressedSize,4),q+=l(W.length,2),q+=l(f.length,2),{fileRecord:k.LOCAL_FILE_HEADER+q+W+f,dirRecord:k.CENTRAL_FILE_HEADER+l(re,2)+q+l(te.length,2)+"\0\0\0\0"+l(O,4)+l(y,4)+W+f+te}}b(i,"n");var o=h("../utils"),m=h("../stream/GenericWorker"),w=h("../utf8"),x=h("../crc32"),k=h("../signature");function C(c,v,u,y){m.call(

15 <br><div class="text-center"><b>• ${m.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/FilesArea-BI-2pgWB.cjsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

17 <b>.jpeg .jpg .png .svg .svgz .gif .bmp .webp .avif .apng .webp .jfif, .pgp</b></div>`},"warning"),w.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены:</div>

18 <br><div class="text-center"><b>• ${w.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

20 </div>`},"warning"),x.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены, потому что максимальный размер

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

22 <br><div class="text-center"><b>• ${x.join("</b><br><b>• ")}</b><br><br></div>`},"warning"),!E.has("files[]")){const v=Object.keys(l).length;v&&this.errorHandler?.({title:"Ошибка",message:`Так${v==1?"ой":"ие"} файл${v==1?"":"ы"} уже есть`}),this.onUploadInProcess=!1;return}const k=new XMLHttpRequest,C=this.uploadPath;k.open("POST",C,!0);let c={};this.uploadHeaders&&(typeof this.uploadHeaders=="function"?c=this.uploadHeaders():c=this.uploadHeaders);for(const v in c)k.setRequestHeader(v,c[v]);k.upload.addEventListener("progress",v=>{if

Long lines were clipped for display.

dist/TextField-BmyvM2dZ.jsView file

1585contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TextField-BmyvM2dZ.jsView on unpkg · L1585

dist/SelectField-CD7n4IhA.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-CXxDalwu.cjs -> dist/SelectField-CD7n4IhA.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-CD7n4IhA.cjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/FilesArea-BI-2pgWB.cjsView file

13`,s=new Blob([E],{type:"text/html"});this.pdfUrl=URL.createObjectURL(s)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Fe,"PdfViewer"),Fe);Ze([Q.... L14: \0`,q+=l(P,2),q+=$.magic,q+=l(S,2),q+=l(D,2),q+=l(ee.crc32,4),q+=l(ee.compressedSize,4),q+=l(ee.uncompressedSize,4),q+=l(W.length,2),q+=l(f.length,2),{fileRecord:k.LOCAL_FILE_HEADE... L15: <br><div class="text-center"><b>• ${m.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/FilesArea-BI-2pgWB.cjsView on unpkg · L13

dist/TextField-BmyvM2dZ.jsView file

1585contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TextField-BmyvM2dZ.jsView on unpkg · L1585

dist/SelectField-CD7n4IhA.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-CXxDalwu.cjs -> dist/SelectField-CD7n4IhA.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-CD7n4IhA.cjsView on unpkg

Findings

2 Critical2 Medium6 Low

CriticalTrojan Source Unicodedist/TextField-BmyvM2dZ.js

CriticalTrigger Reachable Dangerous Capabilitydist/SelectField-CD7n4IhA.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/FilesArea-BI-2pgWB.cjs

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

dist/FilesArea-BI-2pgWB.cjsView file

Lines 1-23javascript

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(d)}" type="application/pdf">

11 </body>

12 </html>

15 <br><div class="text-center"><b>• ${m.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/FilesArea-BI-2pgWB.cjsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

18 <br><div class="text-center"><b>• ${w.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

Long lines were clipped for display.

dist/TextField-BmyvM2dZ.jsView file

1585contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TextField-BmyvM2dZ.jsView on unpkg · L1585

dist/SelectField-CD7n4IhA.cjsView file

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-CXxDalwu.cjs -> dist/SelectField-CD7n4IhA.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-CD7n4IhA.cjsView on unpkg