@atlaskit/editor-plugin-primary-toolbar@31.0.4
Primary toolbar plugin for @atlaskit/editor-core
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe plugin explicitly requests feature-exposure telemetry during runtime, without disclosure or an opt-out visible in the reviewed package. No credential theft or unrelated data collection was identified, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
Editor plugin initialization when contextualFormattingEnabled is true.
Impact
An experiment exposure may be recorded by the configured feature-gate service. The package does not disclose this runtime telemetry or provide an opt-out in the reviewed code.
Mechanism
The package calls the platform_editor_controls experiment helper with exposure enabled, which passes the exposure request to the feature-gate client.
AI rationale
The plugin explicitly requests feature-exposure telemetry during runtime, without disclosure or an opt-out visible in the reviewed package. No credential theft or unrelated data collection was identified, so this warrants a warning rather than a malicious verdict.
Evidence
dist/cjs/pm-plugins/toolbar-configuration.js.lpm-dependency-evidence-4a529173-001f-477b-9036-6132e80ae8a1/1/npm-linux/dist/cjs/editor-experiment.js
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When contextualFormattingEnabled is true, toolbar configuration calls the platform_editor_controls experiment with exposure: true.
- The experiment helper passes that exposure option to the feature-gate client as fireExperimentExposure.
- The package exports the primary toolbar plugin through its configured CJS and ESM entry points.
Evidence against
- The manifest declares no lifecycle scripts or executable bin.
- The reviewed plugin code builds a component registry and toolbar configuration; no credential collection, file access, or unrelated endpoint was identified.
Behavioral surface
Source & flagged code
3 flaggeddist/cjs/pm-plugins/toolbar-configuration.jsView file
14var configuration;
if (contextualFormattingEnabled && (0, _editorExperiment.editorExperiment)('platform_editor_controls', 'variant1', {
exposure: true
})) {
configuration
Medium
Ai Review Evidence
When contextualFormattingEnabled is true, toolbar configuration calls the platform_editor_controls experiment with exposure: true.
dist/cjs/pm-plugins/toolbar-configuration.jsView on unpkg · L14.lpm-dependency-evidence-4a529173-001f-477b-9036-6132e80ae8a1/1/npm-linux/dist/cjs/editor-experiment.jsView file
135var experimentValue = _featureGates.default.getExperimentValue(experimentKey, experimentConfig.param, experimentConfig.defaultValue, {
typeGuard: experimentConfig.typeGuard,
fireExperimentExposure: options.exposure
});
(0, _featureFlagsAccessed.addFeatureFlagAccessed)("".concat(experimentName, ":").concat(experimentConfig.param), expe
Findings
3 Medium
MediumAi Review Evidencedist/cjs/pm-plugins/toolbar-configuration.js
MediumAi Review Evidence.lpm-dependency-evidence-4a529173-001f-477b-9036-6132e80ae8a1/1/npm-linux/dist/cjs/editor-experiment.js
MediumAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @atlaskit/editor-plugin-primary-toolbar@31.0.4.
See all versions of @atlaskit/editor-plugin-primary-toolbar for other recorded verdicts.
- Review the evidence and your use of @atlaskit/editor-plugin-primary-toolbar@31.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.