registry / @bloklabs/core / 1.2.1

@bloklabs/core@1.2.1

Blok — headless, highly extensible rich text editor built for developers who need to implement a block-based editing experience (similar to Notion) without building it from scratch

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The shipped CLI can perform a local migration only when the user explicitly invokes it with a target path; runtime network features operate on configured or user-supplied URLs.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit `migrate-from-editorjs` invocation or editor use with configured URL/media features.

Impact

Caller-selected project files may be rewritten by the CLI; no unconsented persistence, credential collection, or exfiltration was found.

Mechanism

User-directed codemod and browser-side URL fetch/upload helpers.

Rationale

Direct inspection shows a rich-text editor package with an explicitly invoked migration CLI and configured browser networking, not an install-time or covert execution chain. Scanner signals stem from bundled artifacts, benign NODE_ENV checks, static local imports, and expected editor tooling.

Evidence

package.jsoncodemod/migrate-editorjs-to-blok.jssrc/components/modules/blockManager/operations.tssrc/tools/link/metadata-fetcher.tsdist/icons.cjsdist/chunks/aiden0z-pptx-renderer.es-C5x4WRwC.cjssrc/tools/file/uploader.tssrc/tools/image/download.ts

Decision evidence

public snapshot

@bloklabs/core@1.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code