registry / @elyra/canvas / 13.48.0
@elyra/canvas@13.48.0
Elyra common-canvas
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found a UI-library codebase and no concrete malicious chain. Static signals arise from the declared telemetry hook and bundled third-party browser utilities.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation invokes the postinstall command.
Impact
No concrete package-owned malicious behavior established.
Mechanism
declared telemetry CLI invocation
AI rationale
Direct inspection found a UI-library codebase and no concrete malicious chain. Static signals arise from the declared telemetry hook and bundled third-party browser utilities.
Evidence
package.jsonsrc/common-properties/schema-validator/properties-schema-validator.jssrc/common-properties/util/property-utils.jsdist/common-canvas-d02ec92f.jsbuild.shGruntfile.cjsrollup.config.jsdist/common-properties-30f44a99.jsdist/common-canvas-9787be82.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines postinstall: ibmtelemetry --config=telemetry.yml.
- package.json names an IBM telemetry metrics endpoint in a developer config-generation script.
Evidence against
- No telemetry.yml or telemetry source file is packaged.
- Source entrypoints are a React canvas/UI library; no install/import-time package code was found.
- Source searches found no credential, environment, filesystem, shell, or network-exfiltration implementation.
- The flagged dynamic Function/fetch code is bundled D3 utility functionality, not package-controlled payload execution.
- Schema URLs in src/common-properties/schema-validator/properties-schema-validator.js are identifiers registered locally with jsonschema.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/common-properties-30f44a99.jsView file
1import{_ as e,a as t,b as r}from"./createClass-a140e270.js";import{_ as o,a as n,b as i}from"./inherits-860188e5.js";import a,{Component as s}from"react";import{S as l,P as p,f as ...
L2: //# sourceMappingURL=common-properties-30f44a99.js.map
High
Child Process
Package source references child process execution.
Findings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/common-properties-30f44a99.js
HighSame File Env Network Executiondist/common-canvas-9787be82.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbuild.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/common-canvas-9787be82.js
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @elyra/canvas@13.48.0.
See all versions of @elyra/canvas for other recorded verdicts.
- Review the evidence and your use of @elyra/canvas@13.48.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.