@atlaskit/editor-plugin-paste-options-toolbar@31.0.5
Paste options toolbar for @atlaskit/editor-core
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package appears to perform runtime experiment telemetry automatically through expVal, with no user-facing disclosure or opt-out found in the inspected source. The paste contents are used to qualify the event but are not passed to the exposure call, so this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
When the editor plugin runs with the popup menu configured, an exposure feature flag enabled, and qualifying paste state.
Impact
Reports experiment exposure at runtime. The inspected code does not include pasted text in that report.
Mechanism
The plugin evaluates paste text and editor state locally, then calls the experiment exposure API with an experiment key and flag value.
AI rationale
The package appears to perform runtime experiment telemetry automatically through expVal, with no user-facing disclosure or opt-out found in the inspected source. The paste contents are used to qualify the event but are not passed to the exposure call, so this warrants a warning rather than a block.
Evidence
dist/cjs/pasteOptionsToolbarPlugin.jsdist/cjs/ui/on-paste-actions-menu/exposure.js
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- When the popup menu is configured and the exposure feature flag is active, the plugin calls the experiment exposure function after paste-state changes.
- The exposure function uses paste text and document state to decide whether an exposure qualifies, then calls expVal with an experiment name and flag value.
- The package manifest has no lifecycle scripts; its entry point re-exports the editor plugin.
Evidence against
- The exposure call reports an experiment assignment; the source does not pass pasted text to expVal.
- No network endpoint or credential collection is present in the inspected package code.
- The flagged CSS contains ordinary border-radius, shadow, and background-color rules.
Behavioral surface
HighEntropyStrings
Source & flagged code
4 flaggeddist/cjs/ui/on-paste-actions-menu/PasteActionsMenuContent.compiled.cssView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cjs/ui/on-paste-actions-menu/PasteActionsMenuContent.compiled.cssView on unpkgdist/cjs/pasteOptionsToolbarPlugin.jsView file
205(0, _react.useEffect)(function () {
if (config !== null && config !== void 0 && config.usePopupBasedPasteActionsMenu && (0, _fg.fg)('platform_editor_paste_actions_menu_exposure')) {
var _lastContentPasted$te, _lastContentPasted$te2;
(0, _exposure.[redacted])((_lastContentPasted$te = lastContentPasted === null || lastContentPasted === void 0 || (_lastContentPasted$te2 = lastContentPasted.text) ==
Medium
Ai Review Evidence
Findings
1 High3 Medium1 Low
HighSemantic Analysis Limiteddist/cjs/ui/on-paste-actions-menu/PasteActionsMenuContent.compiled.css
MediumAi Review Evidencedist/cjs/pasteOptionsToolbarPlugin.js
MediumAi Review Evidencedist/cjs/ui/on-paste-actions-menu/exposure.js
MediumSuspicious Lifecycle Evidencedist/cjs/index.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @atlaskit/editor-plugin-paste-options-toolbar@31.0.5.
See all versions of @atlaskit/editor-plugin-paste-options-toolbar for other recorded verdicts.
- Review the evidence and your use of @atlaskit/editor-plugin-paste-options-toolbar@31.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.