registry / @bobbykim/manguito-cms-admin / 0.3.0

@bobbykim/manguito-cms-admin@0.3.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Vue CMS admin UI whose browser requests target the configured same-origin admin API; media uploads are activated by user file selection.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User opens the admin UI, authenticates, or chooses a media file to upload.

Impact

Normal administrative API access and file upload; no source evidence of exfiltration, remote payload execution, persistence, or destructive behavior.

Mechanism

CMS API client and user-initiated media upload flow.

Rationale

Direct inspection found a conventional bundled Vue CMS admin package, not malicious behavior. Scanner signals resolve to normal font assets and a U+200D character used by bundled linkification logic rather than Trojan Source controls.

Evidence

package.jsondist/index.jssrc/composables/useApiClient.tssrc/views/media/MediaLibraryView.vuesrc/components/fields/MediaUpload.vuesrc/components/fields/ComputedDisplay.vuedist/assets/ComputedDisplay-C2FpwSB1.jsvite.config.tssrc/App.vuesrc/views/LoginView.vuesrc/main.ts

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has no lifecycle hooks and exports `dist/index.js`.
`dist/index.js` only returns an admin prefix adapter.
`src/composables/useApiClient.ts` uses same-origin `/admin/api` requests with session cookies.
`src/views/media/MediaLibraryView.vue` uploads only a user-selected file via CMS or backend-provided presigned URL.
`ComputedDisplay-C2FpwSB1.js` contains U+200D in bundled linkification data, not a bidi override.
High-entropy findings are bundled `.woff/.woff2` web fonts.

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 46 file(s), 623 KB of source, external domains: example.com, prosemirror.net, www.w3.org

Source & flagged code

2 flagged

dist/assets/ComputedDisplay-C2FpwSB1.jsView file

Lines 74-97javascript

74 background: transparent;

75}

77.ProseMirror-hideselection * {

78 caret-color: transparent;

79}

81.ProseMirror-focused .ProseMirror-gapcursor {

82 display: block;

83}

85.tippy-box[data-animation=fade][data-state=hidden] {

86 opacity: 0

87}`;function hd(e,t,n){let r=document.querySelector(`style[data-tiptap-style${n?`-${n}`:``}]`);if(r!==null)return r;let i=document.createElement(`style`);return t&&i.setAttribute(`nonce`,t),i.setAttribute(`data-tiptap-style${n?`-${n}`:``}`,``),i.innerHTML=e,document.getElementsByTagName(`head`)[0].appendChild(i),i}var gd=class extends Ic{constructor(e={}){super(),this.isFocused=!1,this.isInitialized=!1,this.extensionStorage={},this.options={element:document.createElement(`div`),content:``,injectCSS:!0,injectNonce:void 0,extensions:[],autofocus:!1,editable:!0,editorProps:{},parseOptions:{},coreE ...

89`,textSerializers:n={}}=e||{};return Mu(this.state.doc,{blockSeparator:t,textSerializers:{...gl(this.schema),...n}})}get isEmpty(){return Uu(this.state.doc)}getCharacterCount(){return console.warn(`[tiptap warn]: "editor.getCharacterCount()" is deprecated. Please use "editor.storage.characterCount.characters()" instead.`),this.state.doc.content.size-2}destroy(){if

91`);return!a||!o?!1:e.chain().command(({tr:e})=>(e.delete(r.pos-2,r.pos),!0)).exitCode().run()},ArrowDown:({editor:e})=>{if(!this.options.exitOnArrowDown)return!1;let{state:t}=e,{selection:n,doc:r}=t,{$from:i,empty:a}=n;if(!a||i.parent.type!==this.type||i.parentOffset!==i.parent.nodeSize-2)return!1;let o=i.after();return o===void 0?!1:r.nodeAt(o)?e.commands.command(({tr:e})=>(e.setSelection(L.near(r.resolve(o))),!0)):e.commands.exitCode()}}},addInputRules(){return[yd({find:Vm,type:this.type,getAttributes:e=>({language:e[1]})}),yd({find:Hm,type:this.type,getAttributes:e=>({language:e[1]})})]},ad ...

92`));return a.replaceSelectionWith(this.type.create({language:i},s)),a.selection.$from.parent.type!==this.type&&a.setSelection(R.near(a.doc.resolve(Math.max(0,a.selection.from-2)))),a.setMeta(`paste`,!0),e.dispatch(a),!0}}})]}}),Wm=xd.create({name:`doc`,topNode:!

93`},addCommands(){return{setHardBreak:()=>({commands:e,chain:t,state:n,editor:r})=>e.first([()=>e.exitCode(),()=>e.command(()=>{let{selection:e,storedMarks:i}=n;if(e.$from.parent.type.spec.isolating)return!1

94`,x_=`️`,S_=`‍`,C_=``,w_=null,T_=null;function E_(e=[]){let t={};ug.groups=t;let n=new ug;w_??=A_(Yh),T_??=A_(Xh),Q(n,`'`,Vg),Q(n,`{`,wg),Q(n,`}`,Tg),Q(n,`[`,Eg),Q(n,`]`,Dg),Q(n,`(`,Og),Q(n,`)`,kg),Q(n,`<`,Ag),Q(n,`>`,jg),Q(n,`（`,Mg),Q(n,`）`,Ng),Q(n,`「`,Pg),Q(n,`」`,Fg),Q(n,`『`,Ig),Q(n,`』`,Lg),Q(n,`＜`,Rg),Q(n,`＞`,zg),Q(n,`&`,Bg),Q(n,`*`,Hg),Q(n,`@`,Ug),Q(n,"`",Gg),Q(n,`^`,Kg),Q(n,`:`,qg),Q(n,`,`,Jg),Q(n,`$`,Yg),Q(n,`.`,Xg),Q(n,`=`,Zg),Q(n,`!`,Qg),Q(n,`-`,$g),Q(n,`%`,e_),Q(n,`|`,t_),Q(n,`+`,n_),Q(n,`#`,r_),Q(n,`?`,i_),Q(n,`"`,a_),Q(n,`/`,c_),Q(n,`;`,s_),Q(n,`~`,l_),Q(n,`_`,u_),Q(n,`\\`,Wg),Q(n, ...

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/ComputedDisplay-C2FpwSB1.jsView on unpkg · L94

951. Must only contain digits, lowercase ASCII letters or "-"

962. Cannot start or end with "-"

973. "-" cannot repeat`);$.customSchemes.push([e,t])}function J_(){$.scanner=E_($.customSchemes);for(let e=0;e<$.tokenQueue.length;e++)$.tokenQueue[e][1]({scanner:$.scanner});$.parser=V_($.scanner.tokens);for(let e=0;e<$.pluginQueue.length;e++)$.pluginQueue[e][1]({scanner:$.scanner,parser:$.parser});return $.initialized=!0,$}function Y_(e){return $.initialized||J_(),H_($.parser.start,e,D_($.scanner.start,e))}Y_.scan=D_;function X_(e,t=null,n=null){if(t&&typeof t==`object`){if(n)throw Error(`linkifyjs: Invalid link type ${t}; must be a string`);n=t,t=null}let r=new M_(n),i=Y_(e),a=[];for(let e=0; ...

Long lines were clipped for display.

dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2View file

•path = dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2 kind = high_entropy_blob sizeBytes = 4284 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2View on unpkg

Source & flagged code

2 flagged · loading source

dist/assets/ComputedDisplay-C2FpwSB1.jsView file

94contains invisible/control Unicode U+200D (zero width joiner) `,x_=`️`,S_=`<U+200D>`,C_=``,w_=null,T_=null;function E_(e=[]){let t={};ug.groups=t;let n=new ug;w_??=A_(Yh),T_??=A_(Xh),Q(n,`'`,Vg),Q(n,`{`,wg),Q(n,`}`,Tg),Q(n,`[`,Eg),Q(n,`]`,Dg),Q(n,`(`,Og),Q(n,`)`,kg),Q(n,`<`,Ag),Q(n,`>`,jg),Q(n,`（`,Mg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/ComputedDisplay-C2FpwSB1.jsView on unpkg · L94

dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2View file

•path = dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2 kind = high_entropy_blob sizeBytes = 4284 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2View on unpkg

Findings

1 Critical1 High3 Medium4 Low

CriticalTrojan Source Unicodedist/assets/ComputedDisplay-C2FpwSB1.js

HighShips High Entropy Blobdist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2

MediumNetwork

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/assets/ComputedDisplay-C2FpwSB1.jsView file

Lines 74-97javascript

74 background: transparent;

75}

77.ProseMirror-hideselection * {

78 caret-color: transparent;

79}

81.ProseMirror-focused .ProseMirror-gapcursor {

82 display: block;

83}

85.tippy-box[data-animation=fade][data-state=hidden] {

86 opacity: 0

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/ComputedDisplay-C2FpwSB1.jsView on unpkg · L94

951. Must only contain digits, lowercase ASCII letters or "-"

962. Cannot start or end with "-"

Long lines were clipped for display.

dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2View file

•path = dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2 kind = high_entropy_blob sizeBytes = 4284 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/plus-jakarta-sans-vietnamese-500-normal-DiU8zqi-.woff2View on unpkg