Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@bloklabs/core: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 14 finding(s) warrant review before installing.

View on npm All versions

registry / @bloklabs/core / 1.2.4

@bloklabs/core@1.2.4

Blok — headless, highly extensible rich text editor built for developers who need to implement a block-based editing experience (similar to Notion) without building it from scratch

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No concrete malicious payload or exfiltration path was established. The only install-adjacent behavior is `prepare` invoking Husky; no hook configuration is bundled.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Dependency lifecycle execution of `prepare`, or explicit invocation of `migrate-from-editorjs`.

Impact

Potential local VCS-hook setup; the codemod modifies only user-selected project files.

Mechanism

Husky VCS-hook preparation; user-invoked local codemod rewrites.

Rationale

The scanner's malicious indicators are mostly unsupported by source inspection, but the prepare-only Husky lifecycle action warrants a non-blocking warning under the install-control policy. No concrete malicious behavior was found.

Evidence

package.jsoncodemod/migrate-editorjs-to-blok.jsdist/icons.cjsdist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjs

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` defines `prepare: husky`, an install-adjacent VCS-hook lifecycle action.
`codemod/migrate-editorjs-to-blok.js` can rewrite files, but only when the user explicitly runs its bin command.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence against

No `preinstall`, `install`, or `postinstall` hook is declared in `package.json`.
No bundled `.husky` configuration was found.
Source scan found no child-process, credential harvesting, AI-agent config, or network-exfiltration path.
`dist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjs` contained no bidi control code points; the Trojan Source hint is unsupported.
The dynamic `require` in `dist/icons.cjs` is a fixed local chunk import.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,227 file(s), 51.6 MB of source, external domains: airtable.com, api.onedrive.com, app.diagrams.net, archive.org, assets.pinterest.com, astralcodexten.substack.com, audioboom.com, audiomack.com, base.local, calendly.com, castbox.fm, cdn.example.com, cdn.jsdelivr.net, cdn2.buildin.ai, chevrotain.io, codepen.io, codesandbox.io, coub.com, create.kahoot.it, creators.spotify.com, datawrapper.dwcdn.net, docs.google.com, drive.google.com, drive.usercontent.google.com, e.infogram.com, editor.p5js.org, embed.acast.com, embed.beatport.com, embed.figma.com, embed.kahoot.it, embed.music.apple.com, embed.nicovideo.jp, embed.plnkr.co, embed.podcasts.apple.com, embed.reddit.com, embed.ted.com, embed.tidal.com, embed.wakelet.com, embeds.audioboom.com, en.wikipedia.org, example.com, excalidraw.com, fast.wistia.net, felt.com, flo.uri.sh, form.jotform.com, form.typeform.com, framatube.org, geo.dailymotion.com, giphy.com

Oversized source lightweight scan

dist/blok.iife.js19.6 MB file, sampled 256 KB

HighEntropyStringsMinifiedUrlStringswww.w3.org

dist/blok.umd.js3.22 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinified

Source & flagged code

4 flagged · loading source

src/components/utils/browser.tsView file

14// eslint-disable-next-line no-new-func L15: const globalFactory = new Function('return this') as () => unknown; L16:

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/utils/browser.tsView on unpkg · L14

dist/icons.cjsView file

1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunks/icons-eSINYcRY.cjs`);exports.IconAlignCenter=e.t,exports.IconAlignLeft=e.n,exports.Icon...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/icons.cjsView on unpkg · L1

dist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function ec(e){let t=typeof e==`string`?new RegExp(e):e;return $s.some(e=>t.test(e))}k(ec,`isWhitespace`);function tc(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}k(tc,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjsView on unpkg · L46

dist/blok.iife.jsView file

•path = dist/blok.iife.js kind = oversized_source_file sizeBytes = 20544417 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/blok.iife.jsView on unpkg

Findings

1 Critical1 High5 Medium7 Low

CriticalTrojan Source Unicodedist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjs

HighOversized Source Filedist/blok.iife.js

MediumDynamic Requiredist/icons.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/components/utils/browser.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

78%Warn

Verdict confidence

IntentDangerous Capability

TypeInstall Hook Abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorJackUait

Maintainersjackuait

Version1.2.4

PublishedJul 18, 2026

LicenseApache-2.0

Dependencies0

Integrityverified

Package size20.3 MB

Files1,488

Keywordsbloktext editorrich text editorblock-based editornotion-like editorheadless editorextensible editor

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/blok.cjsmodule → dist/blok.mjstypes → ./types/index.d.tsexports mapbin → migrate-from-editorjs

Runtimenode >=20.19.0

Artifact89.7 MB · 1,488 files1 signature(s)

Install lifecycleprepareprepublishOnly

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkHighEntropyStringsMinifiedObfuscatedProtestwareUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

src/components/utils/browser.tsView file

Lines 1-34typescript

1/**

2 * Browser and environment detection utilities

3 */

4

5type UniversalScope = {

6 window?: Window;

7 document?: Document;

8 navigator?: Navigator;

9};

10

11const globalScope: UniversalScope | undefined = (() => {

12 try {

13 // Use indirect eval to get the global object in any environment

14 // eslint-disable-next-line no-new-func

15 const globalFactory = new Function('return this') as () => unknown;

16

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/utils/browser.tsView on unpkg · L14

17 return globalFactory() as UniversalScope;

18 } catch {

19 return undefined;

20 }

21})();

22

23if (globalScope && typeof globalScope.window === 'undefined') {

24 (globalScope as Record<string, unknown>).window = globalScope;

25}

26

27/**

28 * Returns globally available window object if it exists.

29 */

30const getGlobalWindow = (): Window | undefined => {

31 if (globalScope?.window) {

32 return globalScope.window;

33 }

34

dist/icons.cjsView file

Lines 1-1javascript

1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunks/icons-eSINYcRY.cjs`);exports.IconAlignCenter=e.t,exports.IconAlignLeft=e.n,exports.IconAlignRight=e.r,exports

dist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function ec(e){let t=typeof e==`string`?new RegExp(e):e;return $s.some(e=>t.test(e))}k(ec,`isWhitespace`);function tc(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}k(tc,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjsView on unpkg · L46

dist/blok.iife.jsView file

•path = dist/blok.iife.js kind = oversized_source_file sizeBytes = 20544417 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/blok.iife.jsView on unpkg

.IconArrowDownLine

=

e.i,

exports

.IconArrowUp

=

e.a,

exports

.IconBoard

=

e.o,

exports

.IconBold

=

e.s,

exports

.IconBookmark

=

e.c,

exports

.IconCalendar

=

e.l,

exports

.IconCallout

=

e.u,

exports

.IconCaption

=

e.d,

exports

.IconCaptionImage

=

e.f,

exports

.IconChart

=

e.p,

exports

.IconCheck

=

e.m,

exports

.IconChevronDown

=

e.h,

exports

.IconChevronLeft

=

e.g,

exports

.IconChevronRight

=

e._,

exports

.IconChevronRightSmall

=

e.v,

exports

.IconCloseT

...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/icons.cjsView on unpkg · L1

Long lines were clipped for display.