registry / @atlaskit/editor-plugin-primary-toolbar / 31.0.5
@atlaskit/editor-plugin-primary-toolbar@31.0.5
Primary toolbar plugin for @atlaskit/editor-core
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest and entrypoint describe a toolbar plugin, and the inspected runtime code configures registered toolbar components. No install-time behavior or unrelated network, credential, or account actions were identified.
Static reason
No blocking static signals were detected.
Trigger
The exported plugin is used by an integrating editor; the manifest has no lifecycle scripts.
Impact
No security impact identified from the inspected source.
Mechanism
Registers toolbar components and selects a toolbar layout using editor configuration and an experiment flag.
AI rationale
The manifest and entrypoint describe a toolbar plugin, and the inspected runtime code configures registered toolbar components. No install-time behavior or unrelated network, credential, or account actions were identified.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies an Atlassian editor toolbar plugin, points to the CJS and ESM entrypoints, and lists no lifecycle scripts.
- The CJS entrypoint only re-exports primaryToolbarPlugin.
- The plugin builds a toolbar component registry; its experiment lookup selects a toolbar configuration based on editor settings.
Evidence against
Behavioral surface
Source & flagged code
3 flaggedpackage.jsonView file
17bitbucket.org/atlassian/atlassian-frontend-monorepo",
"main": "dist/cjs/index.js",
"module": "dist/esm/index.js",
"module:es2019": "dist/es2019/index.js",
"types": "dist/types/index.d.ts",
"sideEffects": [
"*.compiled.css"
],
"atlaskit:src": "src/index.ts",
"dependencies": {
"@atlaskit/editor-prosemirror": "^9.0.0",
"@atlaskit/tmp-editor-statsig": "^250.0.0",
"@babel/runtime": "^7.0.0",
"@emotion/react": "^11.7.1"
},
"peerDependencies": {
"@atlaskit/editor-common": "^134.3.0",
"react": "^18.2.0 || ^19.2.0"
},
"devDependencies":
Low
Suspicious Lifecycle Evidence
The manifest identifies an Atlassian editor toolbar plugin, points to the CJS and ESM entrypoints, and lists no lifecycle scripts.
package.jsonView on unpkg · L17dist/cjs/index.jsView file
1"use strict";
Object.defineProperty(exports, "__esModule", {
value: true
});
Object.defineProperty(exports, "primaryToolbarPlugin", {
enumerable: true,
get: function get() {
return _primaryToolbarPlugin.primaryToolbarPlugin;
}
});
var _primaryToolbarPlugin = require("./primaryToolbarPlugin");
Low
Ai Review Evidence
The CJS entrypoint only re-exports primaryToolbarPlugin.
Findings
3 Low
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cjs/index.js
LowAi Review Evidencedist/cjs/pm-plugins/toolbar-configuration.js
Affected versions and remediation
This report applies to @atlaskit/editor-plugin-primary-toolbar@31.0.5.
See all versions of @atlaskit/editor-plugin-primary-toolbar for other recorded verdicts.
- Review the evidence and your use of @atlaskit/editor-plugin-primary-toolbar@31.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.