registry / @bloklabs/core / 1.2.3

@bloklabs/core@1.2.3

Blok — headless, highly extensible rich text editor built for developers who need to implement a block-based editing experience (similar to Notion) without building it from scratch

AI Security Review

scanned 11h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network-capable editor features use endpoints supplied by the host application, and the codemod changes files only when explicitly invoked.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Host application invokes configured upload/bookmark features, or user runs the migration bin.

Impact

No unconsented execution, exfiltration, persistence, or destructive behavior established.

Mechanism

Caller-configured browser fetches and explicit local codemod transforms.

Rationale

Direct inspection shows a configurable editor library plus an explicit migration CLI, not a concrete malicious chain. Scanner flags are explained by a benign zero-width parser delimiter, browser-global compatibility code, bundled artifacts, and host-configured network features.

Evidence

package.jsoncodemod/migrate-editorjs-to-blok.jssrc/components/utils/browser.tssrc/tools/file/uploader.tssrc/tools/link/metadata-fetcher.tsdist/icons.cjsdist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjs

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with false-positive risk.

@bloklabs/core@1.2.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code