registry / @boomi/exosphere / 7.11.0

@boomi/exosphere@7.11.0

A library of Web Components

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Direct inspection shows scanner hits are bundled JSONEditor/Ace functionality, including schema compilation and editor bidi support. No concrete malicious behavior was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports and uses UI components.

Impact

No credential harvesting, exfiltration, persistence, destructive action, or install-time foreign control-surface mutation found.

Mechanism

Client-side component rendering and JSON-schema editing.

AI rationale

Direct inspection shows scanner hits are bundled JSONEditor/Ace functionality, including schema compilation and editor bidi support. No concrete malicious behavior was established.

Evidence

package.jsondist/react/json-editor/index.mjsdist/components/json-editor/json-editor.jsdist/components/rich-input-suggestion/rich-input-suggestion.jsdist/icon.js

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json ships only dist and declares UI-library entrypoints.
prepare references .husky/install.mjs, which is absent from this package.
dist/react/json-editor/index.mjs identifies bundled JSONEditor/Ace code.
Its new Function compiles JSON-schema validation; no payload fetch or execution chain found.
Bidi characters occur in Ace editor RTL/invisible-character handling.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 329 file(s), 27.8 MB of source, external domains: ace.c9.io, ag-grid.com, cdn.jsdelivr.net, fonts.google.com, github.com, jmespath.org, json-schema.org, jsoneditoronline.org, katex.org, mobius.ovh, player.vimeo.com, raw.githubusercontent.com, www.ag-grid.com, www.apache.org, www.sproutcore.com, www.w3.org

Source & flagged code

5 flagged

dist/components/rich-input-suggestion/rich-input-suggestion.jsView file

Lines 1-21javascript

1var Ps=Object.create;var pn=Object.defineProperty;var ki=Object.getOwnPropertyDescriptor;var js=Object.getOwnPropertyNames;var Hs=Object.getPrototypeOf,Is=Object.prototype.hasOwnProperty;var Us=(p,o)=>()=>(o||p((o={exports:{}}).exports,o),o.exports);var Ds=(p,o,l,u)=>{if(o&&typeof o=="object"||typeof o=="function")for(let f of js(o))!Is.call(p,f)&&f!==l&&pn(p,f,{get:()=>o[f],enumerable:!(u=ki(o,f))||u.enumerable});return p};var Fs=(p,o,l)=>(l=p!=null?Ps(Hs(p)):{},Ds(o||!p||!p.__esModule?pn(l,"default",{value:p,enumerable:!0}):l,p));var ft=(p,o,l,u)=>{for(var f=u>1?void 0:u?ki(o,l):o,v=p.length ...

2In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var d,g=!0,E=!1;return{s:function(){s=s.call(i)},n:function(){var y=s.next();return g=y.done,y},e:function(y){E=!0,d=y},f:function(){try{g||s.return==null||s.return()}finally{if(E)throw d}}}}(n.childNodes);try{for(e.s();!(t=e.n()).done;){var r=t.value;if(r.nodeType===T&&!In(r)||r.nodeType===P)return!1}}catch(i){e.e(i)}finally{e.f()}return!0}function In(n){return n.nodeType===T&&!n.nodeValue}function Un(n){return n.nodeType===T&&_e(n)===0}function Dn(n){return n.nodeType===P&&n.tagName==="BR"}function _e(n){if( ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/components/rich-input-suggestion/rich-input-suggestion.jsView on unpkg · L1

3In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,s=!0,h=!1;return{s:function(){e=e.call(n)},n:function(){var c=e.next();return s=c.done,c},e:function

4In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}var U,Xe,dr,pr,gr,Qe,Et,Ye,vr,bo=[["\xAB","\xBB"],["\xBB","\xAB"],['"','"'],["\u201C","\u201D"],["\u201D","\u201D"],["\u201C","\u201C"],["\u201E","\u201C"]],Eo=[["\u2018","\u2019"],["\u2039","

5In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}function Yt(n){return Yt=Object.setPrototypeOf?Object.getPrototypeOf.bind():function(t){return t.__proto__||Object.getPrototypeOf(t)},Yt(n)}function Ge(n,

6`)}(n,!(arguments.length>1&&arguments[1]!==void 0)||arguments[1],function(e){t+=e}),t},highlightMatches:function(n,t

7In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,s=!0,h=!1;return{s:function(){e=e.call(n)},n:function(){var c=e.next();return s=c.done,c},e:function(c){h=!0,a=c},f:function(){try{s||e.return==null||e.return()}finally{if(h)throw a}}}}function Nr(n,t){(t==null||t>n.length)&&(t=n.length);for(var e=0,r=new Array(t);e<t;e++)r[e]=n[e];return r}var Ze={highlightText:function(n,t,e,r){if(!this.hasHighlight(n,e)){var i=Q.extractText(n),a='<span class="highlight-'.concat(r,'"></span>'),s=function(h,c,d){return Tr(h,[c],"text",d)}(i,t,Ze.createMarkerNode(a,r,thi ...

8In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var g,E=!0,y=!1;return{s:function(){h=h.call(a)},n:function(){var C=h.next();return E=

9In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,s=!0,h=!1;return{s:function(){e=e.call(n)},n:function(){var c=e.next();return s=c.done,c},e:function(c){h=!0,a=c},f:function(){try{s||e.return==null||e.return()}finally{if(h)throw a}}}}function jr(n,t){(t==null||t>n.length)&&(t=n.length);for(var e=0,r=new Array(t);e<t;e++)r[e]=n[e];return r}tn.key=tn.prototype.key={left:37,up:38,right:39,down:40,tab:9,esc:27,backspace:8,delete:46,enter:13,shift:16,ctrl:17,alt:18,b:66,i:73};var Gt=!1,jo=function(){function n(t){f(this,n);var e=t.win;Ar(this,t),this.suppor ...

10In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,s=!0,h=!1;return{s:function(){e=e.call(n)},n:function(){var c=e.next();return s=c.done,c},e

11In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,s=!0,h=!1;return{s:function(){e=e.call(n)},n:function(){var c=e.next();return s=c.done,c},e:function(c){h

12Make sure to test your application with a production build as repeat registrations will throw in production.`);else throw new Error(`Failed to execute 'define' on 'CustomElementRegistry': the name "${o}" has already been used with this

13\f\r]`,Mt=/<(?:(!--|\/[^a-zA-Z])|(\/?[a-zA-Z][^>\s]*)|(\/?$))/g,Li=/-->/g,Bi=/>/g,nt=RegExp(`>|${vn}(?:([^\\s"'>=/]+)(${vn}*=${vn}*(?:[^

14\f\r"'\`<>=]|("|')|))|$)`,"g"),Pi=/'/g,ji=/"/g,Di=/^(?:script|style|textarea|title)$/i,wn=p=>(o,...l)=>({_$litType$:p,strings:o,values:l}),Fi=wn(1),ul=

15 :host {

16 border: var(--exo-spacing-3x-small) solid transparent;

17 display: block;

18 }

19 :host(:focus) {

20 border: var(--exo-spacing-3x-small) solid

21 var(--exo-color-background-action-hover);

Long lines were clipped for display.

dist/components/json-editor/json-editor.jsView file

312} L313: `}),ace.define("ace/theme/textmate",["require","exports","module","ace/theme/textmate-css","ace/lib/dom"],function(C,f,T){"use strict";f.isDark=!1,f.cssClass="ace-tm",f.cssText=C("... L314: ab`+(me=me||"")+`cde fg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/components/json-editor/json-editor.jsView on unpkg · L312

dist/react/json-editor/index.mjsView file

6217contains invisible/control Unicode U+202B (right-to-left embedding) for (T[T.length - 1] === N.DOT && (h[T.length - 1] = N.B), T[0] === "<U+202B>" && (h[0] = N.RLE), D = 0; D < b.length; D++)

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/react/json-editor/index.mjsView on unpkg · L6217

•Trigger-reachable chain: manifest.exports -> dist/react/index.mjs -> dist/react/json-editor/index.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/react/json-editor/index.mjsView on unpkg

dist/icon.jsView file

•path = dist/icon.js kind = oversized_source_file sizeBytes = 3874788 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/icon.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/components/rich-input-suggestion/rich-input-suggestion.jsView file

1var Ps=Object.create;var pn=Object.defineProperty;var ki=Object.getOwnPropertyDescriptor;var js=Object.getOwnPropertyNames;var Hs=Object.getPrototypeOf,Is=Object.prototype.hasOwnPr... L2: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var d,g=!0,E=!1;return{s:function(){s=s.call(i)},n:function(){var y=s.next();return g=y.done,y}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/components/rich-input-suggestion/rich-input-suggestion.jsView on unpkg · L1

dist/components/json-editor/json-editor.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/components/json-editor/json-editor.jsView on unpkg · L312

Findings

2 Critical1 High4 Medium7 Low

CriticalTrojan Source Unicodedist/react/json-editor/index.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/react/json-editor/index.mjs

HighOversized Source Filedist/icon.js

MediumDynamic Requiredist/components/json-editor/json-editor.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/components/rich-input-suggestion/rich-input-suggestion.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @boomi/exosphere@7.11.0.

See all versions of @boomi/exosphere for other recorded verdicts.

Review the evidence and your use of @boomi/exosphere@7.11.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-28 09:06:14.087Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.