registry / @atlaskit/media-viewer / 54.8.20
@atlaskit/media-viewer@54.8.20
MediaViewer is Atlassian's powerful solution for viewing files on the web. It's both powerful and extendable yet easy-to-integrate
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection found package-aligned viewer behavior and no concrete malicious chain. The unresolved parser coverage requires a cautious warning decision.
Static reason
No blocking static signals were detected.
Trigger
Importing the viewer or previewing an archive.
Impact
No confirmed exfiltration, persistence, installation-time mutation, or destructive action.
Mechanism
Client-side media viewing and archive previewing.
AI rationale
Source inspection found package-aligned viewer behavior and no concrete malicious chain. The unresolved parser coverage requires a cautious warning decision.
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Static semantic coverage remains incomplete because the scanner reported an AST parse error.
- The manifest exposes browser module entry points and marks compiled CSS as side effects.
- The flagged stylesheet contains ordinary visual layout and font rules.
Evidence against
- No lifecycle scripts or self-dependency are declared in the inspected manifest.
- The package entry point only exports the media viewer loader.
- The archive code obtains a media-client binary URL and passes it to a ZIP reader during archive preview; no fixed external endpoint was found.
- No child-process, environment harvesting, shell execution, eval, or persistence primitive was found in the inspected distribution search.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
3 flaggeddist/cjs/styleWrappers.compiled.cssView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cjs/styleWrappers.compiled.cssView on unpkg1._11q75a80{background:linear-gradient(180deg,#101214,rgba(14,22,36,0)) no-repeat}
._151kfhey._151kfhey h1{font:var(--ds-font-body,normal 400 14px/20px "Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif)}
._2rkofajl{border-radius:var(--ds-radius-small,3px)}
._zulpu2gc{gap:var(--ds-space-100,8px)}._11pt15ty svg{filter:drop-shadow(0 1px 1px rgb(9 30 66/25%)) drop-shadow(0 0 1px rgb(9 30 66/31%))}
Medium
Ai Review Evidence
The flagged stylesheet contains ordinary visual layout and font rules.
dist/cjs/styleWrappers.compiled.cssView on unpkg · L1package.jsonView file
Findings
1 High3 Medium2 Low
HighSemantic Analysis Limiteddist/cjs/styleWrappers.compiled.css
MediumNetwork
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/cjs/styleWrappers.compiled.css
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @atlaskit/media-viewer@54.8.20.
See all versions of @atlaskit/media-viewer for other recorded verdicts.
- Review the evidence and your use of @atlaskit/media-viewer@54.8.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.