registry / @atlaskit/media-viewer / 54.8.21
@atlaskit/media-viewer@54.8.21
MediaViewer is Atlassian's powerful solution for viewing files on the web. It's both powerful and extendable yet easy-to-integrate
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe inspected manifest has no lifecycle scripts, and the flagged source implements browser media viewing and archive decompression. No concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the media viewer and selects an archive.
Impact
No unconsented file, credential, command, or configuration action was found.
Mechanism
Fetches a media-client-provided archive URL for browser-side ZIP preview.
AI rationale
The inspected manifest has no lifecycle scripts, and the flagged source implements browser media viewing and archive decompression. No concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes browser-oriented module entrypoints and contains no install lifecycle hook.
- The entrypoint only exports the media viewer loader.
- The flagged archive code obtains a media-client URL and unzips the selected archive in the viewer.
- The flagged CSS artifact contains presentation rules only.
Evidence against
- No child-process, shell, credential-harvesting, persistence, or dynamic-code primitives were found in the inspected distribution.
- No fixed network endpoint or package-authored exfiltration path was found.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
5 flaggeddist/cjs/styleWrappers.compiled.cssView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cjs/styleWrappers.compiled.cssView on unpkg1._11q75a80{background:linear-gradient(180deg,#101214,rgba(14,22,36,0)) no-repeat}
._151kfhey._151kfhey h1{font:var(--ds-font-body,normal 400 14px/20px "Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif)}
._2rkofajl{border-radius:var(--ds-radius-small,3px)}
._zulpu2gc{gap:var(--ds-space-100,8px)}._11pt15ty svg{filter:drop-shadow(0 1px 1px rgb(9 30 66/25%)) drop-shadow(0 0 1px rgb(9 30 66/31%))}
Low
Ai Review Evidence
The flagged CSS artifact contains presentation rules only.
dist/cjs/styleWrappers.compiled.cssView on unpkg · L1package.jsonView file
Findings
1 High1 Medium6 Low
HighSemantic Analysis Limiteddist/cjs/styleWrappers.compiled.css
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cjs/index.js
LowAi Review Evidencedist/cjs/viewers/archiveSidebar/archive.js
LowAi Review Evidencedist/cjs/styleWrappers.compiled.css
Affected versions and remediation
This report applies to @atlaskit/media-viewer@54.8.21.
See all versions of @atlaskit/media-viewer for other recorded verdicts.
- Review the evidence and your use of @atlaskit/media-viewer@54.8.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.