registry / zj-plugin-intelligent / 1.2.10

zj-plugin-intelligent@1.2.10

> 智能客服 / 智能体客户端 Vue 2 插件库。 > 通过 npm 包（`zj-plugin-intelligent`）方式发布，宿主项目引入后挂载全局组件 `ZjkjIntelligent`，提供 AI 会话、TokUI 动态表单、文件上传、语音交互等能力。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

When the plugin is configured and shown, it loads executable JavaScript from a remote CDN. No install-time attack surface is present.

Static reason

No blocking static signals were detected.

Trigger

Host application configures and opens the plugin component.

Impact

A CDN response change or compromise can execute arbitrary code in the host page.

Mechanism

Unpinned remote script injection into the host document.

AI rationale

This is a real runtime remote-code loading risk, but the inspected package does not show a concrete malicious action. The hidden gzip finding is benign duplication of the minified bundle.

Evidence

lib/ZjPluginIntelligent.common.jspackage.jsonlib/.gz

Network endpoints1

cdn.static.jingyingbang.com/web/libs/zjkj/spiderHack/spiderHack.umd.min.js

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Runtime setup injects an unpinned third-party CDN script with no integrity check.

zj-plugin-intelligent@1.2.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code