registry / @bloklabs/core / 1.2.4

@bloklabs/core@1.2.4

Blok — headless, highly extensible rich text editor built for developers who need to implement a block-based editing experience (similar to Notion) without building it from scratch

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No concrete malicious payload or exfiltration path was established. The only install-adjacent behavior is `prepare` invoking Husky; no hook configuration is bundled.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Dependency lifecycle execution of `prepare`, or explicit invocation of `migrate-from-editorjs`.

Impact

Potential local VCS-hook setup; the codemod modifies only user-selected project files.

Mechanism

Husky VCS-hook preparation; user-invoked local codemod rewrites.

Rationale

The scanner's malicious indicators are mostly unsupported by source inspection, but the prepare-only Husky lifecycle action warrants a non-blocking warning under the install-control policy. No concrete malicious behavior was found.

Evidence

package.jsoncodemod/migrate-editorjs-to-blok.jsdist/icons.cjsdist/chunks/chunk-NNHCCRGN-dw2owIdJ.mjs

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` defines `prepare: husky`, an install-adjacent VCS-hook lifecycle action.
`codemod/migrate-editorjs-to-blok.js` can rewrite files, but only when the user explicitly runs its bin command.

@bloklabs/core@1.2.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code