@doocs/md-cli@2.1.4
WeChat Markdown Editor | 一款高度简洁的微信 Markdown 编辑器：支持 Markdown 语法、自定义主题样式、内容管理、多图床、AI 助手等特性
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically initializes Google Analytics when the editor page loads, with no visible disclosure or opt-out in the inspected page. The reviewed credential flows are associated with user-configured upload providers, so the evidence supports a telemetry warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user opens the editor page served by the CLI.
Impact
Page and browser usage telemetry is sent to Google without a visible consent or opt-out mechanism in the inspected page.
Mechanism
The page loads gtag.js from Google and initializes a fixed measurement ID.
AI rationale
The package automatically initializes Google Analytics when the editor page loads, with no visible disclosure or opt-out in the inspected page. The reviewed credential flows are associated with user-configured upload providers, so the evidence supports a telemetry warning rather than a malicious verdict.
Evidence
dist/index.html
Network endpoints1
www.googletagmanager.com/gtag/js?id=G-7NZL3PZ0NK
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled editor loads Google’s gtag script and configures a Google Analytics measurement ID when its page loads.
- Cloud uploads occur only on an explicit /upload request and use credentials supplied for the configured cloud provider.
Evidence against
- The CLI serves the editor on 127.0.0.1; no install lifecycle scripts are declared.
- The inspected credential flows are tied to configured upload providers, rather than automatic collection of unrelated credentials.
Behavioral surface
CryptoDynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/static/js/md-extensions-og253-_Q.jsView file
5`),De=[`skinparam backgroundColor ${w.background}`,`skinparam defaultFontColor ${w.text}`,`skinparam shadowing false`,`skinparam classBackgroundColor ${w.surface}`,`skinparam class...
L6: `);function Oe(e,t){let n=T(t)===`dark`?De:Ee,r=e.trim(),i=!r.includes(`@start`)||!r.includes(`@end`)?`@startuml\n${r}\n@enduml`:r;return i.includes(n)?i:i.replace(/@startuml\r?\n/...
L7: `){let e=`</span>`.repeat(r.length);t.push(n+e),n=r.join(``),i++}else n+=e[i],i++;return t.push(n),t}var Je=new Ce(128);function Ye(e,t,n,r){let i=`${t}\u0000${r?`1`:`0`}\u0000${e}...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/static/js/md-extensions-og253-_Q.jsView on unpkg · L5util.jsView file
1import FormData from 'form-data'
L2: import process from 'node:process'
...
L7: * Custom console colors.
L8: * https://stackoverflow.com/questions/9781218/how-to-change-node-jss-console-font-color
L9: * Node built-in colors: https://nodejs.org/api/util.html#util_foreground_colors
...
L78: method: `POST`,
L79: }).then(res => res.json())
L80: }
Low
Findings
1 Critical1 High4 Medium6 Low
CriticalTrojan Source Unicodedist/static/js/md-esm-BroXWwW6.js
HighSemantic Analysis Limiteddist/static/js/md-dist-uBjEN_C-.js#virtual:normalized:round1
MediumDynamic Requiredist/static/js/md-extensions-og253-_Q.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.html
LowScripts Present
LowEval
LowWeak Cryptoutil.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @doocs/md-cli@2.1.4.
See all versions of @doocs/md-cli for other recorded verdicts.
- Review the evidence and your use of @doocs/md-cli@2.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.