Loading npm security reports…
> 智能客服 / 智能体客户端 Vue 2 插件库。 > 通过 npm 包（`zj-plugin-intelligent`）方式发布，宿主项目引入后挂载全局组件 `ZjkjIntelligent`，提供 AI 会话、TokUI 动态表单、文件上传、语音交互等能力。
No confirmed malicious attack surface was established. The package is a browser-facing Vue bundle with no install-time lifecycle hook.
The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.
Package source references a known benign dynamic code generation pattern.
lib/ZjPluginKnowledgeBase.umd.jsView on unpkg · L14Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
lib/.gzView on unpkgA package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
lib/ZjPluginIntelligent.umd.min.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/ZjPluginIntelligent.common.jsView on unpkgThis report applies to zj-plugin-intelligent@1.2.15.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references a known benign dynamic code generation pattern.
lib/ZjPluginKnowledgeBase.umd.jsView on unpkg · L14Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
lib/.gzView on unpkgA package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
lib/ZjPluginIntelligent.umd.min.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/ZjPluginIntelligent.common.jsView on unpkg