registry / vue-spear-tip / 0.6.32

vue-spear-tip@0.6.32

Vue 3 TypeScript Class Components with @Watch, Computed (as getter), @Prop decorators. And UI KIT on them.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. File transfer APIs are component features activated with consumer-supplied URLs.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer renders FilesArea and invokes configured download, preview, or upload behavior.

Impact

No unconsented package-side impact identified.

Mechanism

User-configured browser file transfer.

Rationale

The scanner's Trojan Source finding is a false positive: the inspected characters are U+200B caret placeholders in a bundled tag-input dependency, not directional overrides. The package contains ordinary Vue UI components; its network behavior is explicit, runtime, and driven by consumer-configured file endpoints.

Evidence

package.jsondist/vue-spear-tip.cjs.jsdist/SelectField-rFxG_MB7.cjsdist/FilesArea-ChdqaB2j.cjsdist/index-DJhJzeAi.cjsdist/.vite/manifest.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks.
dist/vue-spear-tip.cjs.js only re-exports Vue library components.
dist/SelectField-rFxG_MB7.cjs zero-width characters are Tagify caret placeholders, not bidi controls.
dist/FilesArea-ChdqaB2j.cjs network calls use consumer-provided file URIs/uploadPath.
No Node filesystem, child-process, credential, or agent-control code found in shipped CJS modules.

Behavioral surface

Source

ChildProcessCryptoEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 8.12 MB of source, external domains: bun.com, developer.mozilla.org, github.com, nodejs.org, prosemirror.net, pugjs.org, sass-lang.com, stuk.github.io, tailwindcss.com, unocss.dev, vite.dev, w3c.github.io, www.npmjs.com, www.typescriptlang.org, www.w3.org

Source & flagged code

3 flagged

docs/static/main-gedgkk0T.jsView file

Lines 1-32javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["static/SelectField-Yirulnoa.js","static/FieldComponent.vue_vue_type_script_lang-CDYI4gIT.js","static/SelectField-BT8RpE8j.css","static/StringField-DPNpH-VP.js","static/NoSymbolIcon-C_zbcx4l.js","static/StringField-BQ8zxNZA.css","static/SwitchField-CaOZM__E.js","static/SwitchField-hsdioOol.css","static/TextField-CzLibDTh.js","static/_commonjsHelpers-BO6-jdEg.js","static/TextField-B8YrWckL.css","static/FilesArea-CH7785Ov.js","static/FilesArea-BhxhwiJC.css","static/DateField-BwaNQTDq.js","static/DateField-CBjsJTv1.css","static/Button-C2QaU ...

2var ca=Object.defineProperty;var Ls=bn=>{throw TypeError(bn)};var eo=(bn,Rn)=>ca(bn,"name",{value:Rn,configurable:!0});var as=(bn,Rn,Gn)=>Rn.has(bn)||Ls("Cannot "+Gn);var Br=(bn,Rn

3`),Jn]);else{const co=[`[Vue warn]: ${bn}`,...Rn];Jn.length&&co.push(`

4`,...formatTrace(Jn)),console.warn(...co)}resetTracking(),isWarning=!1}eo(warn$1,"warn$1");function getComponentTrace(){let bn=stack[stack.length-1];if(!bn)return[];const Rn=[];for(;bn;){const Gn=Rn[0];Gn&&Gn.vnode===bn?Gn.recurseCount++:Rn.push({vnode:bn,recurseCount:0});const Kn=bn.component&&bn.component.parent;bn=Kn&&Kn.vnode}return Rn}eo(getComponentTrace,"getComponentTrace");function formatTrace(bn){const Rn=[];return bn.forEach((Gn,Kn)=>{Rn.push(...Kn===0?[]:[`

5`],...formatTraceEntry(Gn))}),Rn}eo(formatTrace,"formatTrace");function formatTraceEntry({vnode:bn,recurseCount:Rn}){const Gn=Rn>0?`... (${Rn} recursive calls)`:"",Kn=bn.component?bn.component.parent==null:!1,Jn=` at <${formatComponentName(bn.component,bn.type,Kn)}`,co=">"+Gn;return bn.props?[Jn,...formatProps(bn.props),co]:[Jn+co]}eo(formatTraceEntry,"formatTraceEntry");function formatProps(bn){const Rn=[],Gn=Object.keys(bn);return Gn.slice(0,3).forEach(Kn=>{Rn.push(...formatProp(Kn,bn[Kn]))}),Gn.length>3&&Rn.push(" ..."),Rn}eo(formatProps,"formatProps");function formatProp(bn,Rn,Gn){return i ...

6`+Io+` AT

7`;return function(){var Wo=new Error("get-stack-trace"),ar=Wo&&Wo.stack?Wo.stack.replace(/^[^\(]+?[\n$]/gm,"").replace(/^\s+at\s+/gm,"").replace(/^Object

8 ${Gn?.asTextarea?`<textarea

9 id="sm-modal-prompt-input" class="form-control" placeholder="Введите текст"

10 style="padding: 8px; min-height: 280px; min-width: 280px"

11 ></textarea>`:'<input type="text" placeholder="Введите текст" id="sm-modal-prompt-input" class="form-control">'}

12 <div id="sm-modal-prompt-error" class="text-danger" style="display: none; font-size: 11px"></div>

13 </div>`,po={...typeof Gn=="object"?Gn:{},id:Jn,content:(typeof Gn=="string"?Gn:Gn?.content??"")+co,onCancel:Gn?.onCancel,confirmCloseDisable:!0,onOpen(mo){let vo,bo;if(typeof Kn=="function"){let wo,Co=!1;const yo=eo((xo=!1)=>{!Co&&xo&&(Co=!0,typeof Gn.onConfirm=="function"&&Gn.onConfirm(mo,bo?.value)),$VST.vueModalComponent.closeModal(Jn)},"confirm");vo=document.getElementById(`modal-${Jn}`),vo&&(vo.classList.add("sm-modal-confirm-button"),vo.removeEventListener("click",()=>{}),vo.removeEventListener("keyup",()=>{}),vo.removeEventListener("keydown",()=>{})),bo=document.getElementById("sm-m ...

14h2(class="absolute l-25 t-2 bg-stone-100 px9px py2px rounded-md") Result:

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/main-gedgkk0T.jsView on unpkg · L12

15div(class="flex items-center justify-center h100%")

16 .title

17 div(class="h90px m20px")

18 div Test: {{ test }}

19 Button(

20 class="h30px"

21 fontSize="14px"

22 @clickTap="test = test == 'test' ? 'test 2' : 'test'"

23 ) Toggle title

24 Button(

25 class="h30px"

26 fontSize="12px"

27 theme="danger"

28 @clickTap="test = ''"

29 ) Reset

30 div(class="mt7px")

31 small(class="text-stone") Computed: {{ computed }}

32 `})]),createBaseVNode("div",_hoisted_6$7,[Rn[13]||(Rn[13]=createBaseVNode("h2",{class:"absolute l-25 t-2 bg-stone-100 px9px py2px rounded-md"},"Result:",-1)),createBaseVNode("div",_hoisted_7$6,[createBaseVNode("div",_hoisted_8$5,[createBaseVNode("div",_hoisted_9$5,[createBaseVNode("div",null,"Test: "+toDisplayString(bn.test),1),

Long lines were clipped for display.

dist/SelectField-rFxG_MB7.cjsView file

Lines 18-58javascript

18 tabIndex="`).concat(i.a11y.focusableTags?0:-1,`"

19 class="`).concat(i.classNames.tag," ").concat(t.class||"",`"

20 `).concat(this.getAttributes(t),`>

21 <x title='' tabIndex="`).concat(i.a11y.focusableTags?0:-1,'" class="').concat(i.classNames.tagX,`" role='button' aria-label

Source & flagged code

3 flagged · loading source

docs/static/main-gedgkk0T.jsView file

12<div id="sm-modal-prompt-error" class="text-danger" style="display: none; font-size: 11px"></div> L13: </div>`,po={...typeof Gn=="object"?Gn:{},id:Jn,content:(typeof Gn=="string"?Gn:Gn?.content??"")+co,onCancel:Gn?.onCancel,confirmCloseDisable:!0,onOpen(mo){let vo,bo;if(typeof Kn=="... L14: h2(class="absolute l-25 t-2 bg-stone-100 px9px py2px rounded-md") Result:

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/main-gedgkk0T.jsView on unpkg · L12

dist/SelectField-rFxG_MB7.cjsView file

38contains invisible/control Unicode U+200B (zero width space) <U+200B>`);for(var d=a.nextSibling,u="";d;)u+=d.textContent,d=d.nextSibling;u.trim()&&F(a.previousSibling)}else a.previousSibling&&!T(a.previousSibling)||a.before("<U+200B>")}),s.removedNodes.forEach(function(a){a&&a.nodeName=="BR"&&z.call(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/SelectField-rFxG_MB7.cjsView on unpkg · L38

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-DJhJzeAi.cjs -> dist/SelectField-rFxG_MB7.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-rFxG_MB7.cjsView on unpkg

Findings

2 Critical2 Medium6 Low

CriticalTrojan Source Unicodedist/SelectField-rFxG_MB7.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/SelectField-rFxG_MB7.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldocs/static/main-gedgkk0T.js

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

docs/static/main-gedgkk0T.jsView file

Lines 1-32javascript

2var ca=Object.defineProperty;var Ls=bn=>{throw TypeError(bn)};var eo=(bn,Rn)=>ca(bn,"name",{value:Rn,configurable:!0});var as=(bn,Rn,Gn)=>Rn.has(bn)||Ls("Cannot "+Gn);var Br=(bn,Rn

3`),Jn]);else{const co=[`[Vue warn]: ${bn}`,...Rn];Jn.length&&co.push(`

6`+Io+` AT

7`;return function(){var Wo=new Error("get-stack-trace"),ar=Wo&&Wo.stack?Wo.stack.replace(/^[^\(]+?[\n$]/gm,"").replace(/^\s+at\s+/gm,"").replace(/^Object

8 ${Gn?.asTextarea?`<textarea

9 id="sm-modal-prompt-input" class="form-control" placeholder="Введите текст"

10 style="padding: 8px; min-height: 280px; min-width: 280px"

11 ></textarea>`:'<input type="text" placeholder="Введите текст" id="sm-modal-prompt-input" class="form-control">'}

12 <div id="sm-modal-prompt-error" class="text-danger" style="display: none; font-size: 11px"></div>

14h2(class="absolute l-25 t-2 bg-stone-100 px9px py2px rounded-md") Result:

Low

Eval

Package source references a known benign dynamic code generation pattern.

docs/static/main-gedgkk0T.jsView on unpkg · L12

15div(class="flex items-center justify-center h100%")

16 .title

17 div(class="h90px m20px")

18 div Test: {{ test }}

19 Button(

20 class="h30px"

21 fontSize="14px"

22 @clickTap="test = test == 'test' ? 'test 2' : 'test'"

23 ) Toggle title

24 Button(

25 class="h30px"

26 fontSize="12px"

27 theme="danger"

28 @clickTap="test = ''"

29 ) Reset

30 div(class="mt7px")

31 small(class="text-stone") Computed: {{ computed }}

Long lines were clipped for display.

dist/SelectField-rFxG_MB7.cjsView file

Lines 18-58javascript

18 tabIndex="`).concat(i.a11y.focusableTags?0:-1,`"

19 class="`).concat(i.classNames.tag," ").concat(t.class||"",`"

20 `).concat(this.getAttributes(t),`>

21 <x title='' tabIndex="`).concat(i.a11y.focusableTags?0:-1,'" class="').concat(i.classNames.tagX,`" role='button' aria-label