registry / yqform-h5 / 0.2.15

yqform-h5@0.2.15

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious package behavior was found. The main residual risk is runtime loading of third-party CDN scripts during image/PDF compression and package-aligned API calls that may include an Authorization header.

Static reason

One or more suspicious static signals were detected.

Trigger

Browser runtime use of the Vue component, especially file/image compression or remote picker data loading.

Impact

Potential supply-chain exposure to cdnjs-hosted scripts in consuming apps; no evidence of credential exfiltration or install-time compromise.

Mechanism

user-invoked browser UI network/API helpers and CDN script injection for document/image libraries

Rationale

Static inspection found runtime CDN loading and auth-bearing API helpers, but no lifecycle hooks, stealth persistence, credential harvesting to an attacker endpoint, destructive behavior, or agent-control mutation. Treat as suspicious due third-party runtime code loading rather than malicious.

Evidence

package.jsonREADME.mddist/yqform-h5.es.jsdist/yqform-h5.umd.js

Network endpoints3

cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.jscdnjs.cloudflare.com/ajax/libs/pdf-lib/1.17.1/pdf-lib.min.jscdnjs.cloudflare.com/ajax/libs/pdf.js/2.11.338/pdf.min.js

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/yqform-h5.es.js dynamically appends script tags for JSZip, pdf-lib, and pdf.js from cdnjs.
dist/yqform-h5.es.js ImageCompressorCls constructor calls addAllLibrary(), so compression use loads remote browser code.
dist/yqform-h5.es.js axios helper reads localStorage Authorization and sends it to configured/requested API paths.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks or bin entrypoint.
Entrypoints are bundled Vue/Vant form display components: dist/yqform-h5.es.js and dist/yqform-h5.umd.js.
Network behavior is runtime UI/API functionality; no hardcoded exfiltration host was found beyond cdnjs library URLs.
No child_process, filesystem persistence, destructive commands, native binary loading, or AI-agent control-surface writes found.
README describes a Vue form display component used with yqform-edit/yqform-edit-next.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.19 MB of source, external domains: cdnjs.cloudflare.com, npms.io

Source & flagged code

2 flagged

dist/yqform-h5.es.jsView file

12272patternName = generic_password severity = medium line = 12272 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/yqform-h5.es.jsView on unpkg · L12272

dist/yqform-h5.umd.jsView file

Lines 13-43javascript

13/* [wrapped with `+i+`] */

14`)}function rI(r){return Ae(r)||no(r)||!!(sm&&r&&r[sm])}function lr(r,i){var c=typeof r;return i=i??Z,!!i&&(c=="number"||c!="symbol"&&g_.test(r))&&r>-1&&r%1==0&&r<i}function Rt(r,i,c){if(!Je(c))return!1;var m=typeof i;return(m=="number"?zt(c)&&lr(i,c.length):m=="string"&&i in c)?Bn(c[i],r):!1}function qu(r,i){if(Ae(r))return!1;var c=typeof r;return c=="number"||c=="symbol"||c=="boolean"||r==null||tn(r)?!0:e_.test(r)||!Zx.test(r)||i!=null&&r in Qe(i)}function oI(r){var i=typeof r;return i=="string"||i=="number"||i=="symbol"||i=="boolean"?r!=="__proto__":r===null}function Xu(r){var i=Gs(r),c=_[i ...

15`;r.replace(se,function(ve,De,Pe,nn,Ft,rn){return Pe||(Pe=nn),ne+=r.slice(J,rn).replace(y_,a7),De&&(O=!0,ne+=`' +

16__e(`+De+`) +

17'`),Ft&&(W=!0,ne+=`';

18`+Ft+`;

19__p += '`),Pe&&(ne+=`' +

20((__t = (`+Pe+`)) == null ? '' : __t) +

21'`),J=rn+ve.length,ve}),ne+=`';

22`;var be=Ye.call(i,"variable")&&i.variable;if(!be)ne=`with (obj) {

23`+ne+`

24}

25`;else if(l_.test(be))throw new Ie(d);ne=(W?ne.replace(Qx,""):ne).replace($x,"$1").replace(jx,"$1;"),ne="function("+(be||"obj")+`) {

26`+(be?"":`obj || (obj = {});

27`)+"var __t, __p = ''"+(O?", __e = _.escape":"")+(W?`, __j = Array.prototype.join;

28function print() { __p += __j.call(arguments, '') }

29`:`;

30`)+ne+`return __p

31}`;var Be=z2(function(){return He(I,me+"return "+ne).apply(n,V)});if(Be.source=ne,od(Be))throw Be;return Be}function TV(r){return Ke(r).toLowerCase()}function DV(r){

32`).forEach(function(u){s=u.indexOf(":"),n=u.substring(0,s).trim().toLowerCase(),a=u.substring(s+1).trim(),!(!n||t[n]&&Ey[n])&&(n==="set-cookie"?t[n]?t[n].push(a):t[n]=[a]:t[n]=t[n]?t[n]+", "+a:a)}),t},Xf=Symbol("internals");function ai(e){return e&&String(e).trim().toLowerCase()}function ya(e){return e===!1||e==null?e:X.isArray(e)?e.map(ya):String(e)}function _y(e){const t=Object.create(null),n=/([^\s,;=]+)\s*(?:=\s*([^,;]+))?/g;let a;for(;a=n.exec(e);)t[a[1]]=a[2];return t}const Sy=e=>/^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(e.trim());function Ml(e,t,n,a,s){if(X.isFunction(a))return a.call(this, ...

33`)}get[Symbol.toStringTag](){return"AxiosHeaders"}static from(t){return t instanceof this?t:new this(t)}static concat(t,...n){const a=new this(t);return n.forEach(s=>a.set(s)),a}static accessor(t){const a=(this[Xf]=this[Xf]={accessors:{}}).accessors,s=this.prototype;function l(u){const d=ai(u);a[d]||(ky(s,u),a[d]=!0)}return X.isArray(t)?t.forEach(l):l(t),this}}wa.accessor(["Content-Type","Content-Length","Accept","Accept-Encoding","User-Agent","Authorization"]),X.freezeMethods(wa.prototype),X.freezeMethods(wa);const $n=wa;function Ul(e,t){const n=this||Ll,a=t||n,s=$n.from(a.headers);let l=a.da ...

Medium

Secret Pattern

Hardcoded password in dist/yqform-h5.umd.js

dist/yqform-h5.umd.jsView on unpkg · L33

34 * vue-draggable-next v2.2.0

36 * @license MIT

37 *//**!

38 * Sortable 1.14.0

39 * @author RubaXa <trash@rubaxa.org>

40 * @author owenm <owen23355@gmail.com>

41 * @license MIT

42 */function s0(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter(function(s){return Object.getOwnPropertyDescriptor(e,s).enumerable})),n.push.apply(n,a)}return n}function Ln(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]!=null?arguments[t]:{};t%2?s0(Object(n),!0).forEach(function(a){ab(e,a,n[a])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):s0(Object(n)).forEach(function(a){Object.defineProperty(e,a,Object.getOwnPropertyDescriptor(n,a))})}return e}function xa(e){"@babel/ ...

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/yqform-h5.es.jsView file

12272patternName = generic_password severity = medium line = 12272 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/yqform-h5.es.jsView on unpkg · L12272

dist/yqform-h5.umd.jsView file

33patternName = generic_password severity = medium line = 33 matchedText = `)}get[S...;/*!

Medium

Secret Pattern

Hardcoded password in dist/yqform-h5.umd.js

dist/yqform-h5.umd.jsView on unpkg · L33

Findings

4 Medium4 Low

MediumSecret Patterndist/yqform-h5.es.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/yqform-h5.umd.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/yqform-h5.es.jsView file

12272patternName = generic_password severity = medium line = 12272 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/yqform-h5.es.jsView on unpkg · L12272

dist/yqform-h5.umd.jsView file

Lines 13-43javascript

13/* [wrapped with `+i+`] */

15`;r.replace(se,function(ve,De,Pe,nn,Ft,rn){return Pe||(Pe=nn),ne+=r.slice(J,rn).replace(y_,a7),De&&(O=!0,ne+=`' +

16__e(`+De+`) +

17'`),Ft&&(W=!0,ne+=`';

18`+Ft+`;

19__p += '`),Pe&&(ne+=`' +

20((__t = (`+Pe+`)) == null ? '' : __t) +

21'`),J=rn+ve.length,ve}),ne+=`';

22`;var be=Ye.call(i,"variable")&&i.variable;if(!be)ne=`with (obj) {

23`+ne+`

24}

25`;else if(l_.test(be))throw new Ie(d);ne=(W?ne.replace(Qx,""):ne).replace($x,"$1").replace(jx,"$1;"),ne="function("+(be||"obj")+`) {

26`+(be?"":`obj || (obj = {});

27`)+"var __t, __p = ''"+(O?", __e = _.escape":"")+(W?`, __j = Array.prototype.join;

28function print() { __p += __j.call(arguments, '') }

29`:`;

30`)+ne+`return __p

31}`;var Be=z2(function(){return He(I,me+"return "+ne).apply(n,V)});if(Be.source=ne,od(Be))throw Be;return Be}function TV(r){return Ke(r).toLowerCase()}function DV(r){

Medium

Secret Pattern

Hardcoded password in dist/yqform-h5.umd.js

dist/yqform-h5.umd.jsView on unpkg · L33

34 * vue-draggable-next v2.2.0

36 * @license MIT

37 *//**!

38 * Sortable 1.14.0

39 * @author RubaXa <trash@rubaxa.org>

40 * @author owenm <owen23355@gmail.com>

41 * @license MIT

Long lines were clipped for display.