registry / @elyra/canvas / 13.50.0
@elyra/canvas@13.50.0
Elyra common-canvas
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found a package-aligned IBM telemetry postinstall configuration and standard bundled application code, not a concrete malicious chain. The static signals for environment access, dynamic code, child process, and network activity do not establish hostile behavior in this package.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook.
Impact
No credential theft, destructive action, persistence, or remote code execution was verified.
Mechanism
Configured telemetry command.
AI rationale
Static inspection found a package-aligned IBM telemetry postinstall configuration and standard bundled application code, not a concrete malicious chain. The static signals for environment access, dynamic code, child process, and network activity do not establish hostile behavior in this package.
Evidence
telemetry.yml
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Installation runs an IBM telemetry command using a local configuration file.
- The telemetry configuration names a fixed IBM metrics endpoint.
- Flagged bundled files contain ordinary UI environment guards, schema identifiers, a global-object compatibility helper, and an ELK module export marker.
Evidence against
- No package-authored credential harvesting, shell execution, file mutation, persistence, or remote payload loader was found.
- There is no self-dependency on @elyra/canvas.
- The observed network configuration is package-aligned telemetry rather than an undisclosed exfiltration path.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/common-properties-96a2a6e5.jsView file
1"use strict";var e=require("./createClass-df7b07d6.js"),t=require("./inherits-74e481d1.js"),r=require("react"),o=require("./index-f55e16e9.js"),n=require("./Close-e20bee64.js"),i=r...
L2: //# sourceMappingURL=common-properties-96a2a6e5.js.map
High
Child Process
Package source references child process execution.
Findings
5 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/common-properties-96a2a6e5.js
HighSame File Env Network Executiondist/common-canvas-bc1db195.js
HighSemantic Analysis Limiteddist/elk.bundled-21f32edb.js
HighPrevious Version Dangerous Deltadist/common-canvas-utils-fc086bd5.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbuild.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/common-canvas-bc1db195.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @elyra/canvas@13.50.0.
See all versions of @elyra/canvas for other recorded verdicts.
- Review the evidence and your use of @elyra/canvas@13.50.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.