@atlaskit/media-viewer@54.12.2
MediaViewer is Atlassian's powerful solution for viewing files on the web. It's both powerful and extendable yet easy-to-integrate
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe viewer automatically reports media identifiers and file metadata in runtime analytics, with no consent or opt-out visible in the inspected source. This is suspicious telemetry, but the source does not establish a malicious collector or credential theft.
Decision evidence
public snapshot- When a media file loads, the viewer sends its file attributes to a UFO experience event.
- Those attributes include the file ID, media type, MIME type, and file size.
- The event adds package version, media environment, and region; the source shows no user consent or opt-out for this runtime reporting.
- The package is a media viewer, and the event is tied to a file load rather than running at import time.
- The entry point exports a lazy-loaded viewer; no install lifecycle scripts are declared in the manifest.
- No hard-coded collector host or filesystem write was identified in the inspected paths.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cjs/errorMessage.compiled.cssView on unpkgWhen a media file loads, the viewer sends its file attributes to a UFO experience event.
dist/cjs/ItemViewerBase.jsView on unpkg · L326Findings
Affected versions and remediation
This report applies to @atlaskit/media-viewer@54.12.2.
See all versions of @atlaskit/media-viewer for other recorded verdicts.
- Review the evidence and your use of @atlaskit/media-viewer@54.12.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.