registry / @bigbinary/neeto-editor-frontend / 2.0.1
@bigbinary/neeto-editor-frontend@2.0.1
neetoEditor is the library that drives the rich text experience in all neeto products built at BigBinary
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package is a rich text editor library whose inspected imports and requests support editor features. Its request paths are relative or use the host application's configured knowledge-base URL, and no malicious automatic behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
The exported editor components run when imported or used by an application.
Impact
No evidence of secret collection, unrelated outbound contact, or harmful automatic actions was found.
Mechanism
Observed requests support editor uploads and knowledge-base article lookup, using configured or relative application endpoints.
AI rationale
The package is a rich text editor library whose inspected imports and requests support editor features. Its request paths are relative or use the host application's configured knowledge-base URL, and no malicious automatic behavior was identified.
Network endpoints3
/api/v1/articles/api/direct_uploads/:signedId//neeto_editor/api/v1/direct_uploads/attach
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports editor components from dist entry points and declares no install, preinstall, or postinstall hook.
- The default entry point exports editor features and imports their bundled modules.
- Upload helpers send files through configurable URLs and use relative application paths for direct-upload actions.
- Knowledge-base requests use the application-provided kbUrl and a relative articles path.
Evidence against
- The manifest has a prepare script that runs husky install; it is a development hook, not an install-time data collection action.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggeddist/chunk-CeoqieEt.jsView file
4182try {
L4183: new Function("");
L4184: return true;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunk-CeoqieEt.jsView on unpkg · L4182dist/chunk-BFKmIsWV.jsView file
67L68: /** @type {import("neetocommons/react-utils").ZustandStoreHook} */
L69: var useFileUploadStore = create$1(withImmutableActions(function (set, get) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-BFKmIsWV.jsView on unpkg · L67dist/v2/styles.cssView file
Findings
1 Critical1 High4 Medium6 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/v2/styles.css
MediumDynamic Requiredist/chunk-BFKmIsWV.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/chunk-CeoqieEt.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bigbinary/neeto-editor-frontend@2.0.1.
See all versions of @bigbinary/neeto-editor-frontend for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-editor-frontend@2.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.