registry / @atlaskit/editor-plugin-limited-mode / 27.0.3
@atlaskit/editor-plugin-limited-mode@27.0.3
LimitedMode plugin for @atlaskit/editor-core
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest exposes editor plugin entry points without an install hook or command, and the reviewed code performs editor state and performance monitoring consistent with limited mode. The URL finding does not correspond to a runtime network request.
Static reason
No blocking static signals were detected.
Trigger
The host application imports and invokes the plugin; performance monitoring is enabled only when the relevant feature experiment is active.
Impact
No malicious impact identified; the observed behavior supports the package’s editor functionality.
Mechanism
The plugin evaluates editor state and document thresholds, optionally observes input latency and long tasks, then updates limited-mode state and emits editor analytics when its latch criteria are met.
AI rationale
The manifest exposes editor plugin entry points without an install hook or command, and the reviewed code performs editor state and performance monitoring consistent with limited mode. The URL finding does not correspond to a runtime network request.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to JavaScript editor-plugin entry points and declares no command entry.
- The CommonJS entry point only re-exports limitedModePlugin.
- The plugin’s optional monitoring is gated by feature experiments and responds to editor state.
- The plugin evaluates document size and reports limited-mode latch telemetry through the editor analytics API.
Evidence against
- No lifecycle scripts, credential access, or external network requests were found in the package source reviewed.
- The observed browser measurements and state changes serve the package’s limited-mode editor function.
Behavioral surface
UrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
15"repository": "https://bitbucket.org/atlassian/atlassian-frontend-mirror",
"main": "dist/cjs/index.js",
"module": "dist/esm/index.js",
"module:es2019": "dist/es2019/index.js",
"types": "dist/types/index.d.ts",
"sid
Low
Ai Review Evidence
The manifest points to JavaScript editor-plugin entry points and declares no command entry.
package.jsonView on unpkg · L15dist/cjs/index.jsView file
6Object.defineProperty(exports, "limitedModePlugin", {
enumerable: true,
get: function get() {
return _limitedModePlugin.limitedModePlugin;
}
});
var _limitedModePlugin = require(".
Low
Ai Review Evidence
The CommonJS entry point only re-exports limitedModePlugin.
dist/cjs/index.jsView on unpkg · L6dist/cjs/limitedModePlugin.jsView file
Findings
6 Low
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/cjs/index.js
LowAi Review Evidencedist/cjs/limitedModePlugin.js
LowAi Review Evidencedist/cjs/pm-plugins/main.js
LowAi Review Evidencedist/cjs/pm-plugins/main.js
Affected versions and remediation
This report applies to @atlaskit/editor-plugin-limited-mode@27.0.3.
See all versions of @atlaskit/editor-plugin-limited-mode for other recorded verdicts.
- Review the evidence and your use of @atlaskit/editor-plugin-limited-mode@27.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.