registry / @bigbinary/neeto-editor-frontend / 2.0.3
@bigbinary/neeto-editor-frontend@2.0.3
neetoEditor is the library that drives the rich text experience in all neeto products built at BigBinary
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package manifest and entry points describe a rich text editor, and the reviewed network call supports downloading a caller-provided file. The prepare script only installs Husky, with no install-time data collection or unrelated network activity identified.
Static reason
No blocking static signals were detected.
Trigger
Importing the package exposes editor components; file downloads occur when the editor feature is used.
Impact
No malicious impact was identified.
Mechanism
The reviewed network call fetches a file URL supplied to the download helper; no automatic collection or unrelated destination was identified.
AI rationale
The package manifest and entry points describe a rich text editor, and the reviewed network call supports downloading a caller-provided file. The prepare script only installs Husky, with no install-time data collection or unrelated network activity identified.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports React editor modules from dist entry points.
- The prepare script runs husky install; no install, preinstall, or postinstall hook is declared.
- The file download helper fetches a caller-provided fileUrl to support the editor’s download feature.
Evidence against
- Bundled dependencies contain dynamic module loading, environment-variable references, and network APIs, but reviewed occurrences are consistent with editor functionality and bundled libraries.
- The version adds and changes many generated distribution files, but the manifest reports no new lifecycle scripts or dependencies.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggeddist/chunk-CeoqieEt.jsView file
4182try {
L4183: new Function("");
L4184: return true;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunk-CeoqieEt.jsView on unpkg · L4182dist/chunk-BFKmIsWV.jsView file
67L68: /** @type {import("neetocommons/react-utils").ZustandStoreHook} */
L69: var useFileUploadStore = create$1(withImmutableActions(function (set, get) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-BFKmIsWV.jsView on unpkg · L67dist/v2/styles.cssView file
Findings
1 Critical1 High4 Medium6 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/v2/styles.css
MediumDynamic Requiredist/chunk-BFKmIsWV.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/chunk-CeoqieEt.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bigbinary/neeto-editor-frontend@2.0.3.
See all versions of @bigbinary/neeto-editor-frontend for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-editor-frontend@2.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.