registry / @bigbinary/neeto-editor-frontend / 2.0.2
@bigbinary/neeto-editor-frontend@2.0.2
neetoEditor is the library that drives the rich text experience in all neeto products built at BigBinary
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe shipped entry points expose rich-text editor functionality. The inspected network behavior is tied to configured editor services, and the `prepare` script only installs Husky; no malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
Knowledge-base article checks run when an editor instance is present; other requests follow editor features such as file uploads or document viewing.
Impact
Retrieves article data for editor functionality; no unrelated data collection or harmful side effect was found.
Mechanism
The article lookup uses the host application's configured knowledge-base URL and API key to fetch `/api/v1/articles`.
AI rationale
The shipped entry points expose rich-text editor functionality. The inspected network behavior is tied to configured editor services, and the `prepare` script only installs Husky; no malicious behavior was identified.
Network endpoints2
/api/v1/articles/api/direct_uploads
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports editor components and utility modules through its ESM and CommonJS entry points.
- The prepare script runs `husky install`; no install hook sends data or changes package-manager approvals.
- Knowledge-base requests use `/api/v1/articles`, with the base URL and API key taken from the host application's configured `globalProps`.
- The article check is enabled only when an editor instance exists and is used to check linked article IDs.
- The dynamic `require('crypto')` match is a fallback for generating cryptographically secure random numbers.
Evidence against
- The package has network and filesystem code, but the reviewed paths are for editor features and bundled libraries.
- No unrelated collector, credential discovery, persistence, or destructive action was identified.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flaggeddist/chunk-CeoqieEt.jsView file
4182try {
L4183: new Function("");
L4184: return true;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunk-CeoqieEt.jsView on unpkg · L4182dist/chunk-BFKmIsWV.jsView file
67L68: /** @type {import("neetocommons/react-utils").ZustandStoreHook} */
L69: var useFileUploadStore = create$1(withImmutableActions(function (set, get) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-BFKmIsWV.jsView on unpkg · L67dist/v2/styles.cssView file
Findings
1 Critical1 High4 Medium6 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/v2/styles.css
MediumDynamic Requiredist/chunk-BFKmIsWV.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/chunk-CeoqieEt.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bigbinary/neeto-editor-frontend@2.0.2.
See all versions of @bigbinary/neeto-editor-frontend for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-editor-frontend@2.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.