registry / Credential exfiltration / @calcit/editor

@calcit/editor

Structural Editor for Calcit Language

This report shows the evidence for @calcit/editor@0.9.16. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete credential forwarding to an undisclosed third-party endpoint, not merely an unused dependency or generic network capability. Although it is UI-triggered rather than install-time, it exposes a supplied API credential and prompt data.

Static reason

No blocking static signals were detected.

Trigger

User opens the shipped UI, supplies a Gemini API key, and clicks Run.

Impact

Exposure of the user’s Gemini API key and submitted prompts to ja.chenyong.life.

Mechanism

Gemini API-key forwarding through a hard-coded third-party base URL.

Attack narrative

The bundled UI asks the user for a Gemini key, stores it in localStorage, then creates GoogleGenAI with that key while overriding its base URL to https://ja.chenyong.life. Clicking Run sends the user prompt through this configured client. The package README describes a Calcit editor workflow and does not disclose this third-party Gemini proxy.

AI rationale

Evidence

dist/assets/index-KvGS49Br.jspackage.jsonREADME.md

Network endpoints1

ja.chenyong.life

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

Embedded UI prompts for and stores a Gemini API key.
The Gemini client is configured to use ja.chenyong.life rather than a Google endpoint.
User prompt text is sent through that configured client when Run is clicked.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
The credential path is activated from an explicit UI Run action, not during installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 196 file(s), 2.30 MB of source, external domains: apis.calcit-lang.org, cdn.tiye.me, cirru.org, cos-sh.tiye.me, editor.calcit-lang.org, github.com, r.tiye.me, repo.cirru.org, respo-mvc.org

Oversized source lightweight scan

Source & flagged code

4 flagged

js-out/app.util.compile.mjsView file

Lines 1-30javascript

2import * as $clt from "./calcit.core.mjs";

3import * as $app_DOT_config from "./app.config.mjs";

4import { db__GT_string } from "./app.util.mjs";

5import { extract_examples_code } from "./app.util.mjs";

6import { file__GT_cirru } from "./app.util.mjs";

7import { hide_empty_fields } from "./app.util.mjs";

8import { now_$x_ } from "./app.util.mjs";

9import { tree__GT_cirru } from "./app.util.mjs";

10import chalk from "chalk";

11import * as $child_process from "child_process";

12import crypto from "crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

js-out/app.util.compile.mjsView on unpkg · L10

13import * as $fs from "fs";

14import * as $path from "path";

15const _t_ = $clt.init_tags(["about","added","added-defs","changed","changed-defs","code","configs","defs","entries","error","exp-code","files","init-fn","modules"

17export function handle_calcit_files_$x_(pkg, old_files, latest_files, added_names, removed_names, changed_names, configs, entries, filter_ns) {

18if (arguments.length !== 9) throw $clt._args_throw('handle-calcit-files!', 9, arguments.length);

19let new_files = ($clt.some_$q_(filter_ns) ? (function _fn_(){

20 let target = $clt.get(latest_files, filter_ns);

22 if ($clt.some_$q_(target)) { return $clt.assoc(old_files, filter_ns, target) } else { return $clt.dissoc(old_files, filter_ns) }

23})() : latest_files);

24let calcit_data = (function _fn_(){

25 let tmp_AUTO_1 = (function _fn_(){

26 let tmp_AUTO_2 = $clt.option_$o_unwrap_or($clt.get(configs, _t_["init-fn"]), null);

27 let tmp_AUTO_3 = $clt.option_$o_unwrap_or($clt.get(configs, _t_["reload-fn"]), null);

28 let tmp_AUTO_4 = $clt.option_$o_unwrap_or($clt.get(configs, _t_.modules), null);

29 let tmp_AUTO_5 = $clt.option_$o_unwrap_or($clt.get(configs, _t_.version), null);

30 return $clt._$n__$M_(_t_["init-fn"], tmp_AUTO_2, _t_["reload-fn"], tmp_AUTO_3, _t_.modules, tmp_AUTO_4, _t_.version, tmp_AUTO_5);

.yarn/install-state.gzView file

•path = .yarn/install-state.gz kind = high_entropy_blob sizeBytes = 165924 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = payload_in_excluded_dir sizeBytes = 165924 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = compressed_blob sizeBytes = 165924 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.yarn/install-state.gzView on unpkg

Source & flagged code

4 flagged · loading source

js-out/app.util.compile.mjsView file

10import chalk from "chalk"; L11: import * as $child_process from "child_process"; L12: import crypto from "crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

js-out/app.util.compile.mjsView on unpkg · L10

.yarn/install-state.gzView file

•path = .yarn/install-state.gz kind = high_entropy_blob sizeBytes = 165924 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = payload_in_excluded_dir sizeBytes = 165924 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.yarn/install-state.gz

Findings

2 High4 Medium5 Low

HighShips High Entropy Blob.yarn/install-state.gz

HighPayload In Excluded Dir.yarn/install-state.gz

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blob.yarn/install-state.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptojs-out/app.util.compile.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @calcit/editor@0.9.16.

The versions list below shows the verdict for each recorded version.

Avoid installing @calcit/editor@0.9.16. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-22 16:37:09.625Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.9.16latestshownMaliciousCredential ExfiltrationBlockPublishedAug 22, 2026, 4:35 PM 0.9.15SuspiciousCredential ExfiltrationWarnPublishedAug 22, 2026, 2:53 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code