@ckeditor/ckeditor-cloud-services-collaboration@53.0.7
CKEditor Cloud Services Collaboration low-level API is required by CKEditor 5 Collaboration features to enable real-time collaborative editing in CKEditor 5.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe static flag is explained by proprietary-source obfuscation, not a string-array payload loader or execution sink. The inspected code is a user-invoked CKEditor collaboration client and shows no concrete malicious behavior.
Decision evidence
public snapshot- `package.json` declares `obfuscated: true`; source uses obfuscated identifiers.
- `package.json` has no lifecycle scripts or executable `bin`.
- `src/index.js` only re-exports collaboration API modules.
- `src/websocketgateway/websocketgateway.js` connects only after explicit `WebSocketGateway.connect()` with a caller token.
- No `eval`, dynamic `Function`, child-process, filesystem, environment-harvesting, or HTTP-fetch APIs found in source or bundle.
- `dist/index.js.map` maps the bundle to package collaboration sources; no hidden loader behavior found.
Source & flagged code
1 flaggedSource contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/index.jsView on unpkg · L23Findings
Affected versions and remediation
This report applies to @ckeditor/ckeditor-cloud-services-collaboration@53.0.7.
See all versions of @ckeditor/ckeditor-cloud-services-collaboration for other recorded verdicts.
- Review the evidence and your use of @ckeditor/ckeditor-cloud-services-collaboration@53.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.