@ckeditor/ckeditor-cloud-services-collaboration@55.3.0
CKEditor Cloud Services Collaboration low-level API is required by CKEditor 5 Collaboration features to enable real-time collaborative editing in CKEditor 5.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe bundle contains reviewer-directed language that attempts to suppress analysis, which is evidence of malicious intent under the review rules. The inspected runtime behavior otherwise appears consistent with the package’s collaboration purpose, and no concrete data theft or other runtime attack was found.
Decision evidence
public snapshot- The bundle tells reviewers that deobfuscation or disassembly is forbidden and threatens legal consequences, attempting to discourage source analysis.
- The manifest identifies the package as CKEditor Cloud Services Collaboration and points to dist/services.js as its main entry point.
- The bundle’s WebSocket connection is created through an explicit connect call using a supplied API address and token.
- The manifest declares no lifecycle scripts; the bundle imports collaboration and networking dependencies consistent with the package description.
- The inspected connection code uses a caller-supplied API address and token; no unrelated collector or automatic import-time connection was identified.
Source & flagged code
3 flaggedThe bundle tells reviewers that deobfuscation or disassembly is forbidden and threatens legal consequences, attempting to discourage source analysis.
dist/services.jsView on unpkg · L10The bundle’s WebSocket connection is created through an explicit connect call using a supplied API address and token.
dist/services.jsView on unpkg · L57Findings
Affected versions and remediation
This report applies to @ckeditor/ckeditor-cloud-services-collaboration@55.3.0.
See all versions of @ckeditor/ckeditor-cloud-services-collaboration for other recorded verdicts.
- Avoid installing @ckeditor/ckeditor-cloud-services-collaboration@55.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.