registry / @atlaskit/editor-plugin-primary-toolbar / 31.0.9
@atlaskit/editor-plugin-primary-toolbar@31.0.9
Primary toolbar plugin for @atlaskit/editor-core
AI Security Review
scanned 7h ago · by lpm-firewall-aiThe package exposes an editor toolbar plugin whose inspected runtime code registers components and selects toolbar configuration. No install hooks, unrelated network activity, credential access, or other attack behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
The application imports and initializes the exported plugin.
Impact
Editor toolbar configuration only; no harmful behavior was found.
Mechanism
It registers toolbar components and derives toolbar state; an optional feature experiment selects the toolbar layout.
AI rationale
The package exposes an editor toolbar plugin whose inspected runtime code registers components and selects toolbar configuration. No install hooks, unrelated network activity, credential access, or other attack behavior was identified.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package metadata points to JavaScript module entry points and declares no lifecycle scripts.
- The exported plugin creates a component registry and ProseMirror plugin state for toolbar components.
- The Statsig experiment lookup runs only when contextual formatting is enabled and selects toolbar configuration.
Evidence against
- No install hooks, network requests, or unrelated host references were found in the package runtime code inspected.
Behavioral surface
Source & flagged code
3 flaggedpackage.jsonView file
17"repository": "https://bitbucket.org/atlassian/atlassian-frontend-monorepo",
"main": "dist/cjs/index.js",
"module": "dist/esm/index.js",
"module:es2019": "dist/es2019/index.js",
"types": "dist/types/index.d.ts",
"sideEffects": [
"*.compiled.css"
],
"atlaskit:src": "src/index.ts",
"depende
Low
Suspicious Lifecycle Evidence
The package metadata points to JavaScript module entry points and declares no lifecycle scripts.
package.jsonView on unpkg · L17dist/cjs/primaryToolbarPlugin.jsView file
11var primaryToolbarPlugin = exports.primaryToolbarPlugin = function primaryToolbarPlugin(_ref) {
var config = _ref.config;
// We use a plugin variable to store the component registry to avoid having to use
// effects in each plugin, and to enable rendering the toolbar in SSR
// TODO: ED-26962 - Replace this with something in plugin state once we have a way to initialise across plugins on plugin initialisation
var componentRegistry = new Map();
// Pre-fil
Low
Ai Review Evidence
The exported plugin creates a component registry and ProseMirror plugin state for toolbar components.
dist/cjs/primaryToolbarPlugin.jsFindings
3 Low
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cjs/primaryToolbarPlugin.js
LowAi Review Evidencedist/cjs/pm-plugins/toolbar-configuration.js
Affected versions and remediation
This report applies to @atlaskit/editor-plugin-primary-toolbar@31.0.9.
See all versions of @atlaskit/editor-plugin-primary-toolbar for other recorded verdicts.
- Review the evidence and your use of @atlaskit/editor-plugin-primary-toolbar@31.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.