registry / @elyx-code/editor-nodejs / 0.0.1353

@elyx-code/editor-nodejs@0.0.1353

An installable package of a headless serverside version of the project's editor logic for a NodeJS environment

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Runtime behavior is a headless Elyx editor client that connects to Elyx APIs/websockets using user-supplied credentials, with explicit CLIs for exporting project JSON and generating test boilerplate.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime Editor.setup()/project methods or explicit CLI invocation

Impact

No evidence of unconsented execution, exfiltration, persistence, or destructive mutation

Mechanism

Package-aligned API/websocket client and explicit export/test file generation

Rationale

Static inspection shows package-aligned editor networking and explicit CLI export behavior, with no lifecycle hooks or concrete malicious chain. Token logging is undesirable but local and not paired with exfiltration or install-time execution.

Evidence

package.jsondist/index.jsdist/config.jsdist/export-project.jsdist/export-project-cli.jsdist/create-test-cli.jsdist/modules/uuid.jsdist/test-instance.js../../.env.test../.env.test../../project-logic-tree/src/other-tests

Network endpoints6

api.dev.elyx.techapi.staging.elyx.techapi.elyx.techws.dev.elyx.techwss://ws.staging.elyx.techwss://ws.elyx.tech

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/index.js logs access and refresh tokens during setup, creating local exposure risk if logging is enabled.
dist/export-project-cli.js and dist/create-test-cli.js load .env.test and write user-requested export/test files when explicitly run.

Evidence against

package.json has no preinstall/install/postinstall hooks and no bin entries.
dist/index.js network use is editor/project API and websocket traffic to Elyx service endpoints with caller-provided tokens.
dist/config.js contains public client configuration such as publishable Stripe/Cognito/Google keys, not private credential theft logic.
No child_process, eval/Function, native binary loading, persistence, destructive filesystem behavior, or AI-agent control-surface writes found.
CLI filesystem writes are explicit export/test generation behavior, not install-time or import-time mutation.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 167 KB of source, external domains: api.dev.elyx.tech, api.elyx.tech, api.staging.elyx.tech, app.nango.dev, billing.stripe.com, connect.dev.elyx.tech, connect.elyx.tech, d2i41032bsu0o2.cloudfront.net, d3meuwyksvik3l.cloudfront.net, df2h57ytbvezp.cloudfront.net, elyx-dev-help-articles.s3.eu-central-1.amazonaws.com, elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com, elyx-prod-help-articles.s3.eu-central-1.amazonaws.com, elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com, elyx-staging-help-articles.s3.eu-central-1.amazonaws.com, integrations.dev.elyx.tech, integrations.elyx.tech, ws.dev.elyx.tech

Source & flagged code

4 flagged

dist/config.jsView file

Lines 20-116javascript

20 aws_cognito_signup_attributes: ['EMAIL'],

21 aws_cognito_password_protection_settings: {

22 passwordPolicyMinLength: 8,

23 passwordPolicyCharacters: [

24 'REQUIRES_LOWERCASE',

25 'REQUIRES_UPPERCASE',

26 'REQUIRES_NUMBERS',

27 'REQUIRES_SYMBOLS',

28 ],

29 },

30 aws_cognito_verification_mechanisms: ['EMAIL'],

31 },

32 HELP_ARTICLES_URL: 'https://elyx-dev-help-articles.s3.eu-central-1.amazonaws.com',

33 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

34 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

35 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

36 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

37 HTTP_CLIENT_URL: 'https://df2h57ytbvezp.cloudfront.net',

38 EDITOR_RUNTIME_IP_ADDRESS: '35.157.54.29',

39 GOOGLE_PICKER_APP_ID: '5729685821',

40 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

41 },

42 staging: {

43 stripe_publishable_key: 'pk_test_rYj0t30AfihMVtTZQA2HjjuT',

44 stripe_pricing_table_id: 'prctbl_1TREcAFUJjMj5cqLEALlJZfX',

45 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/test_5kQ5kDftobJmdMvczqgbm00',

46 stripe_org_sub_mngmt_url: '',

47 API_BASE_URL: 'https://api.staging.elyx.tech', // Future staging API

48 WS_URL: 'wss://ws.staging.elyx.tech',

49 amplifyConfig: {

50 aws_project_region: 'eu-central-1',

51 aws_cognito_region: 'eu-central-1',

52 aws_user_pools_id: 'eu-central-1_Hqy56jrad', // Your Staging User Pool ID

53 aws_user_pools_web_client_id: '3p75u41s5b32okj31hr2lvqcer', // Your Staging Client ID

54 aws_cognito_username_attributes: ['EMAIL'],

55 aws_cognito_signup_attributes: ['EMAIL'],

56 aws_cognito_password_protection_settings: {

57 passwordPolicyMinLength: 8,

58 passwordPolicyCharacters: [

59 'REQUIRES_LOWERCASE',

60 'REQUIRES_UPPERCASE',

61 'REQUIRES_NUMBERS',

62 'REQUIRES_SYMBOLS',

63 ],

64 },

65 aws_cognito_verification_mechanisms: ['EMAIL'],

66 },

67 HELP_ARTICLES_URL: 'https://elyx-staging-help-articles.s3.eu-central-1.amazonaws.com',

68 // External integrations for staging share the 'dev' environments resources

69 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

70 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

71 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

72 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

73 HTTP_CLIENT_URL: 'https://d2i41032bsu0o2.cloudfront.net',

74 EDITOR_RUNTIME_IP_ADDRESS: '63.182.186.122',

75 GOOGLE_PICKER_APP_ID: '5729685821',

76 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

77 },

78 prod: {

79 stripe_publishable_key: 'pk_live_HrFGNCp9YrKECgyAh5f4JMZO',

80 stripe_pricing_table_id: 'prctbl_1TRDRIFUJjMj5cqLss0ervUw',

81 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/5kQ5kDftobJmdMvczqgbm00',

82 stripe_org_sub_mngmt_url: '',

83 API_BASE_URL: 'https://api.elyx.tech',

84 WS_URL: 'wss://ws.elyx.tech',

85 amplifyConfig: {

86 aws_project_region: 'eu-central-1',

87 aws_cognito_region: 'eu-central-1',

88 aws_user_pools_id: 'eu-central-1_MzPRdm914',

89 aws_user_pools_web_client_id: '4hejvd5qnn2dhit4trd9kdcb2u',

90 aws_cognito_username_attributes: ['EMAIL'],

91 aws_cognito_signup_attributes: ['EMAIL'],

92 aws_cognito_password_protection_settings: {

93 passwordPolicyMinLength: 8,

94 passwordPolicyCharacters: [

95 'REQUIRES_LOWERCASE',

96 'REQUIRES_UPPERCASE',

97 'REQUIRES_NUMBERS',

98 'REQUIRES_SYMBOLS',

99 ],

100 },

101 aws_cognito_verification_mechanisms: ['EMAIL'],

102 },

103 HELP_ARTICLES_URL: 'https://elyx-prod-help-articles.s3.eu-central-1.amazonaws.com',

104 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com',

105 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.elyx.tech',

106 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.elyx.tech',

107 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

108 HTTP_CLIENT_URL: 'https://d3meuwyksvik3l.cloudfront.net',

109 EDITOR_RUNTIME_IP_ADDRESS: '3.76.93.206',

110 GOOGLE_PICKER_APP_ID: '5729685821',

111 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

112 },

113};

114// Fallback to dev if something goes weird

115exports.envConfig = environments[ENV] || environments.dev;

116

Source & flagged code

4 flagged · loading source

dist/config.jsView file

40patternName = google_api_key severity = high line = 40 matchedText = GOOGLE_P...EA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

40patternName = google_api_key severity = high line = 40 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

76patternName = google_api_key severity = high line = 76 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

111patternName = google_api_key severity = high line = 111 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

Findings

4 High2 Medium4 Low

HighHigh Secretdist/config.js

HighSecret Patterndist/config.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/config.jsView file

Lines 20-116javascript

20 aws_cognito_signup_attributes: ['EMAIL'],

21 aws_cognito_password_protection_settings: {

22 passwordPolicyMinLength: 8,

23 passwordPolicyCharacters: [

24 'REQUIRES_LOWERCASE',

25 'REQUIRES_UPPERCASE',

26 'REQUIRES_NUMBERS',

27 'REQUIRES_SYMBOLS',

28 ],

29 },

30 aws_cognito_verification_mechanisms: ['EMAIL'],

31 },

32 HELP_ARTICLES_URL: 'https://elyx-dev-help-articles.s3.eu-central-1.amazonaws.com',

33 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

34 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

35 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

36 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

37 HTTP_CLIENT_URL: 'https://df2h57ytbvezp.cloudfront.net',

38 EDITOR_RUNTIME_IP_ADDRESS: '35.157.54.29',

39 GOOGLE_PICKER_APP_ID: '5729685821',

40 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

41 },

42 staging: {

43 stripe_publishable_key: 'pk_test_rYj0t30AfihMVtTZQA2HjjuT',

44 stripe_pricing_table_id: 'prctbl_1TREcAFUJjMj5cqLEALlJZfX',

45 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/test_5kQ5kDftobJmdMvczqgbm00',

46 stripe_org_sub_mngmt_url: '',

47 API_BASE_URL: 'https://api.staging.elyx.tech', // Future staging API

48 WS_URL: 'wss://ws.staging.elyx.tech',

49 amplifyConfig: {

50 aws_project_region: 'eu-central-1',

51 aws_cognito_region: 'eu-central-1',

52 aws_user_pools_id: 'eu-central-1_Hqy56jrad', // Your Staging User Pool ID

53 aws_user_pools_web_client_id: '3p75u41s5b32okj31hr2lvqcer', // Your Staging Client ID

54 aws_cognito_username_attributes: ['EMAIL'],

55 aws_cognito_signup_attributes: ['EMAIL'],

56 aws_cognito_password_protection_settings: {

57 passwordPolicyMinLength: 8,

58 passwordPolicyCharacters: [

59 'REQUIRES_LOWERCASE',

60 'REQUIRES_UPPERCASE',

61 'REQUIRES_NUMBERS',

62 'REQUIRES_SYMBOLS',

63 ],

64 },

65 aws_cognito_verification_mechanisms: ['EMAIL'],

66 },

67 HELP_ARTICLES_URL: 'https://elyx-staging-help-articles.s3.eu-central-1.amazonaws.com',

68 // External integrations for staging share the 'dev' environments resources

69 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

70 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

71 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

72 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

73 HTTP_CLIENT_URL: 'https://d2i41032bsu0o2.cloudfront.net',

74 EDITOR_RUNTIME_IP_ADDRESS: '63.182.186.122',

75 GOOGLE_PICKER_APP_ID: '5729685821',

76 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

77 },

78 prod: {

79 stripe_publishable_key: 'pk_live_HrFGNCp9YrKECgyAh5f4JMZO',

80 stripe_pricing_table_id: 'prctbl_1TRDRIFUJjMj5cqLss0ervUw',

81 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/5kQ5kDftobJmdMvczqgbm00',

82 stripe_org_sub_mngmt_url: '',

83 API_BASE_URL: 'https://api.elyx.tech',

84 WS_URL: 'wss://ws.elyx.tech',

85 amplifyConfig: {

86 aws_project_region: 'eu-central-1',

87 aws_cognito_region: 'eu-central-1',

88 aws_user_pools_id: 'eu-central-1_MzPRdm914',

89 aws_user_pools_web_client_id: '4hejvd5qnn2dhit4trd9kdcb2u',

90 aws_cognito_username_attributes: ['EMAIL'],

91 aws_cognito_signup_attributes: ['EMAIL'],

92 aws_cognito_password_protection_settings: {

93 passwordPolicyMinLength: 8,

94 passwordPolicyCharacters: [

95 'REQUIRES_LOWERCASE',

96 'REQUIRES_UPPERCASE',

97 'REQUIRES_NUMBERS',

98 'REQUIRES_SYMBOLS',

99 ],

100 },

101 aws_cognito_verification_mechanisms: ['EMAIL'],

102 },

103 HELP_ARTICLES_URL: 'https://elyx-prod-help-articles.s3.eu-central-1.amazonaws.com',

104 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com',

105 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.elyx.tech',

106 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.elyx.tech',

107 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

108 HTTP_CLIENT_URL: 'https://d3meuwyksvik3l.cloudfront.net',

109 EDITOR_RUNTIME_IP_ADDRESS: '3.76.93.206',

110 GOOGLE_PICKER_APP_ID: '5729685821',

111 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

112 },

113};

114// Fallback to dev if something goes weird

115exports.envConfig = environments[ENV] || environments.dev;

116