registry / @atlaskit/media-viewer / 54.11.21
@atlaskit/media-viewer@54.11.21
MediaViewer is Atlassian's powerful solution for viewing files on the web. It's both powerful and extendable yet easy-to-integrate
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource inspection found no malicious behavior. The flagged network call is limited to reading archive content from a blob URL created by the viewer, and the flagged stylesheet contains presentation rules.
Static reason
No blocking static signals were detected.
Trigger
Rendering an archive entry through a custom renderer.
Impact
This provides the selected archive entry's contents for preview; no external recipient or harmful effect was found.
Mechanism
The viewer fetches the blob URL and returns the resulting blob to the renderer.
AI rationale
Source inspection found no malicious behavior. The flagged network call is limited to reading archive content from a blob URL created by the viewer, and the flagged stylesheet contains presentation rules.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points imports to viewer bundles and lists compiled CSS as its side effect.
- The CommonJS entrypoint loads a lazy viewer loader, which loads the viewer component when rendered.
- Archive entries are converted to blob URLs; the custom renderer can fetch that URL and receive the entry bytes.
- The flagged CSS file contains presentation rules.
Evidence against
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
7 flaggeddist/cjs/styleWrappers.compiled.cssView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 46
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cjs/styleWrappers.compiled.cssView on unpkg1._11q75a80{background:linear-gradient(180deg,#101214,rgba(14,22,36,0)) no-repeat}
._151kfhey._151kfhey h1{font:var(--ds-font-body,normal 400 14px/20px
Low
Ai Review Evidence
The flagged CSS file contains presentation rules.
dist/cjs/styleWrappers.compiled.cssView on unpkg · L1package.jsonView file
11"main": "dist/cjs/index.js",
"module": "dist/esm/index.js",
"module:es2019": "dist/es2019/index.js",
"types": "dist/types/index.d.ts",
"sideEffects": [
"*.compiled.css"
],
"atlaskit:src": "src/index.ts",
"atlass
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/cjs/styleWrappers.compiled.css
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/cjs/styleWrappers.compiled.css
LowAi Review Evidencedist/cjs/index.js
LowAi Review Evidencedist/cjs/components/media-viewer-loader.js
LowAi Review Evidencedist/cjs/viewers/archiveSidebar/archive-viewer-base.js
LowAi Review Evidencedist/cjs/viewers/archiveSidebar/archive-viewer-base.js
Affected versions and remediation
This report applies to @atlaskit/media-viewer@54.11.21.
See all versions of @atlaskit/media-viewer for other recorded verdicts.
- Review the evidence and your use of @atlaskit/media-viewer@54.11.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.