registry / yqform-h5 / 0.2.18

yqform-h5@0.2.18

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Vue form component bundle with user-invoked form, upload, image/PDF conversion, camera, and API option lookup behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

runtime use of Vue component methods by consuming application

Impact

No unconsented install/import-time mutation or exfiltration identified

Mechanism

browser UI component with axios helper and media processing utilities

Rationale

The suspicious signals are explained by a bundled browser form component and dependencies: axios, localStorage auth header propagation, CDN library loading, FileReader/camera/canvas usage, and base64 image assets. There is no lifecycle hook, stealth execution path, credential harvesting beyond app-scoped Authorization use, or concrete malicious chain.

Evidence

package.jsonREADME.mddist/yqform-h5.es.jsdist/yqform-h5.umd.js

Network endpoints4

cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.jscdnjs.cloudflare.com/ajax/libs/pdf-lib/1.17.1/pdf-lib.min.jscdnjs.cloudflare.com/ajax/libs/pdf.js/2.11.338/pdf.min.js/services/bl/api/user/hospital

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/yqform-h5.es.js loads JSZip/pdf-lib/pdf.js from cdnjs at runtime for document/image conversion features.
dist/yqform-h5.es.js reads localStorage Authorization and sends it as a Bearer header in app API helper.
dist/yqform-h5.es.js uses camera/FileReader/canvas for ID photo, signature, and upload UI flows.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks and only exports dist bundles.
README.md describes a Vue/Vite/Vant form display component used with yqform-edit packages.
Network calls are user/runtime driven form option lookups or package-aligned media conversion helpers, not install-time execution.
No child_process, filesystem harvesting, persistence, destructive behavior, or AI-agent control-surface writes found.
Observed Function("return this") and cookie/header code are bundled lodash/axios library internals.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.20 MB of source, external domains: cdnjs.cloudflare.com, npms.io

Source & flagged code

2 flagged

dist/yqform-h5.es.jsView file

12272patternName = generic_password severity = medium line = 12272 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/yqform-h5.es.jsView on unpkg · L12272

dist/yqform-h5.umd.jsView file

Lines 13-43javascript

13/* [wrapped with `+i+`] */

14`)}function uI(r){return Ae(r)||no(r)||!!(sm&&r&&r[sm])}function lr(r,i){var c=typeof r;return i=i??Z,!!i&&(c=="number"||c!="symbol"&&E_.test(r))&&r>-1&&r%1==0&&r<i}function Ft(r,i,c){if(!Je(c))return!1;var m=typeof i;return(m=="number"?Kt(c)&&lr(i,c.length):m=="string"&&i in c)?Bn(c[i],r):!1}function qu(r,i){if(Ae(r))return!1;var c=typeof r;return c=="number"||c=="symbol"||c=="boolean"||r==null||nn(r)?!0:s_.test(r)||!a_.test(r)||i!=null&&r in Qe(i)}function dI(r){var i=typeof r;return i=="string"||i=="number"||i=="symbol"||i=="boolean"?r!=="__proto__":r===null}function Xu(r){var i=js(r),c=_[i ...

15`;r.replace(se,function(ve,De,Oe,rn,Lt,on){return Oe||(Oe=rn),ne+=r.slice(J,on).replace(__,h7),De&&(P=!0,ne+=`' +

16__e(`+De+`) +

17'`),Lt&&(W=!0,ne+=`';

18`+Lt+`;

19__p += '`),Oe&&(ne+=`' +

20((__t = (`+Oe+`)) == null ? '' : __t) +

21'`),J=on+ve.length,ve}),ne+=`';

22`;var be=Ye.call(i,"variable")&&i.variable;if(!be)ne=`with (obj) {

23`+ne+`

24}

25`;else if(g_.test(be))throw new Ie(d);ne=(W?ne.replace(Zx,""):ne).replace(e_,"$1").replace(t_,"$1;"),ne="function("+(be||"obj")+`) {

26`+(be?"":`obj || (obj = {});

27`)+"var __t, __p = ''"+(P?", __e = _.escape":"")+(W?`, __j = Array.prototype.join;

28function print() { __p += __j.call(arguments, '') }

29`:`;

30`)+ne+`return __p

31}`;var Be=z2(function(){return He(I,me+"return "+ne).apply(n,V)});if(Be.source=ne,od(Be))throw Be;return Be}function MV(r){return Ke(r).toLowerCase()}function UV(r){

32`).forEach(function(u){s=u.indexOf(":"),n=u.substring(0,s).trim().toLowerCase(),a=u.substring(s+1).trim(),!(!n||t[n]&&Ey[n])&&(n==="set-cookie"?t[n]?t[n].push(a):t[n]=[a]:t[n]=t[n]?t[n]+", "+a:a)}),t},Xf=Symbol("internals");function ai(e){return e&&String(e).trim().toLowerCase()}function ya(e){return e===!1||e==null?e:X.isArray(e)?e.map(ya):String(e)}function _y(e){const t=Object.create(null),n=/([^\s,;=]+)\s*(?:=\s*([^,;]+))?/g;let a;for(;a=n.exec(e);)t[a[1]]=a[2];return t}const Sy=e=>/^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(e.trim());function Ml(e,t,n,a,s){if(X.isFunction(a))return a.call(this, ...

33`)}get[Symbol.toStringTag](){return"AxiosHeaders"}static from(t){return t instanceof this?t:new this(t)}static concat(t,...n){const a=new this(t);return n.forEach(s=>a.set(s)),a}static accessor(t){const a=(this[Xf]=this[Xf]={accessors:{}}).accessors,s=this.prototype;function l(u){const d=ai(u);a[d]||(ky(s,u),a[d]=!0)}return X.isArray(t)?t.forEach(l):l(t),this}}wa.accessor(["Content-Type","Content-Length","Accept","Accept-Encoding","User-Agent","Authorization"]),X.freezeMethods(wa.prototype),X.freezeMethods(wa);const $n=wa;function Ul(e,t){const n=this||Ll,a=t||n,s=$n.from(a.headers);let l=a.da ...

Medium

Secret Pattern

Hardcoded password in dist/yqform-h5.umd.js

dist/yqform-h5.umd.jsView on unpkg · L33

34 * vue-draggable-next v2.2.0

36 * @license MIT

37 *//**!

38 * Sortable 1.14.0

39 * @author RubaXa <trash@rubaxa.org>

40 * @author owenm <owen23355@gmail.com>

41 * @license MIT

42 */function s0(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter(function(s){return Object.getOwnPropertyDescriptor(e,s).enumerable})),n.push.apply(n,a)}return n}function Ln(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]!=null?arguments[t]:{};t%2?s0(Object(n),!0).forEach(function(a){hb(e,a,n[a])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):s0(Object(n)).forEach(function(a){Object.defineProperty(e,a,Object.getOwnPropertyDescriptor(n,a))})}return e}function xa(e){"@babel/ ...

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/yqform-h5.es.jsView file

12272patternName = generic_password severity = medium line = 12272 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/yqform-h5.es.jsView on unpkg · L12272

dist/yqform-h5.umd.jsView file

33patternName = generic_password severity = medium line = 33 matchedText = `)}get[S...;/*!

Medium

Secret Pattern

Hardcoded password in dist/yqform-h5.umd.js

dist/yqform-h5.umd.jsView on unpkg · L33

Findings

4 Medium4 Low

MediumSecret Patterndist/yqform-h5.es.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/yqform-h5.umd.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/yqform-h5.es.jsView file

12272patternName = generic_password severity = medium line = 12272 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/yqform-h5.es.jsView on unpkg · L12272

dist/yqform-h5.umd.jsView file

Lines 13-43javascript

13/* [wrapped with `+i+`] */

15`;r.replace(se,function(ve,De,Oe,rn,Lt,on){return Oe||(Oe=rn),ne+=r.slice(J,on).replace(__,h7),De&&(P=!0,ne+=`' +

16__e(`+De+`) +

17'`),Lt&&(W=!0,ne+=`';

18`+Lt+`;

19__p += '`),Oe&&(ne+=`' +

20((__t = (`+Oe+`)) == null ? '' : __t) +

21'`),J=on+ve.length,ve}),ne+=`';

22`;var be=Ye.call(i,"variable")&&i.variable;if(!be)ne=`with (obj) {

23`+ne+`

24}

25`;else if(g_.test(be))throw new Ie(d);ne=(W?ne.replace(Zx,""):ne).replace(e_,"$1").replace(t_,"$1;"),ne="function("+(be||"obj")+`) {

26`+(be?"":`obj || (obj = {});

27`)+"var __t, __p = ''"+(P?", __e = _.escape":"")+(W?`, __j = Array.prototype.join;

28function print() { __p += __j.call(arguments, '') }

29`:`;

30`)+ne+`return __p

31}`;var Be=z2(function(){return He(I,me+"return "+ne).apply(n,V)});if(Be.source=ne,od(Be))throw Be;return Be}function MV(r){return Ke(r).toLowerCase()}function UV(r){

Medium

Secret Pattern

Hardcoded password in dist/yqform-h5.umd.js

dist/yqform-h5.umd.jsView on unpkg · L33

34 * vue-draggable-next v2.2.0

36 * @license MIT

37 *//**!

38 * Sortable 1.14.0

39 * @author RubaXa <trash@rubaxa.org>

40 * @author owenm <owen23355@gmail.com>

41 * @license MIT

Long lines were clipped for display.