registry / @bloklabs/core / 1.2.0

@bloklabs/core@1.2.0

Blok — headless, highly extensible rich text editor built for developers who need to implement a block-based editing experience (similar to Notion) without building it from scratch

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Normal installation has no install-time package mutation, and network uploads require editor configuration supplied by the integrator.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit execution of `migrate-from-editorjs` or runtime use of configured editor upload features.

Impact

The codemod can rewrite the path explicitly selected by its user; uploads send only user-provided file or URL data to user-configured endpoints.

Mechanism

User-invoked source migration and caller-configured browser uploads.

Rationale

Source inspection does not establish credential theft, exfiltration, remote payload execution, persistence, destructive behavior, or AI-agent control-surface mutation. The scanner findings map to normal editor features, an explicit codemod, benign global detection, and a harmless zero-width text literal.

Evidence

package.jsoncodemod/migrate-editorjs-to-blok.jssrc/tools/file/uploader.tssrc/components/utils/browser.tsdist/chunks/aiden0z-pptx-renderer.es-C5x4WRwC.cjs

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

@bloklabs/core@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code