registry / zj-plugin-intelligent / 1.2.13

zj-plugin-intelligent@1.2.13

> 智能客服 / 智能体客户端 Vue 2 插件库。 > 通过 npm 包（`zj-plugin-intelligent`）方式发布，宿主项目引入后挂载全局组件 `ZjkjIntelligent`，提供 AI 会话、TokUI 动态表单、文件上传、语音交互等能力。

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Opening and configuring the chat component causes the package to inject a remotely hosted JavaScript file into the host page. That remote code executes with the page's privileges.

Static reason

No blocking static signals were detected.

Trigger

A host application opens the component and supplies user parameters.

Impact

A compromised or changed CDN asset could run arbitrary browser-side code in applications using this package.

Mechanism

Runtime injection of an unpinned external script.

AI rationale

There is no install-time attack or confirmed secret theft, but an unpinned runtime remote-script loader is a concrete supply-chain execution risk. The compressed artifact is a duplicate bundle rather than an independently hidden executable payload.

Evidence

lib/ZjPluginIntelligent.common.js

Network endpoints1

cdn.static.jingyingbang.com/web/libs/zjkj/spiderHack/spiderHack.umd.min.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The runtime bundle creates a script element and loads a remote spiderHack JavaScript file from a CDN when chat user parameters are set.

zj-plugin-intelligent@1.2.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code