registry / @elyx-code/editor-nodejs / 0.0.1357

@elyx-code/editor-nodejs@0.0.1357

An installable package of a headless serverside version of the project's editor logic for a NodeJS environment

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a headless Elyx editor client that connects to Elyx API/websocket endpoints when user code calls setup/export helpers with credentials.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import/use of Editor or explicit export/create-test CLI invocation

Impact

Fetches/updates Elyx project data using caller-provided tokens; optional CLI writes JSON/test boilerplate to user-selected paths.

Mechanism

package-aligned API/websocket client and optional local export writer

Rationale

Static inspection found user-invoked editor/export functionality with package-aligned network calls and local file writes, plus local token logging risk, but no install-time execution, exfiltration, remote payload execution, persistence, or destructive behavior. Scanner secret/network hints are explained by client configuration and normal Elyx service access.

Evidence

package.jsondist/config.jsdist/index.jsdist/export-project.jsdist/export-project-cli.jsdist/create-test-cli.js.env.testmock-project-record-*.json*.test.ts

Network endpoints6

api.dev.elyx.techws.dev.elyx.techapi.staging.elyx.techwss://ws.staging.elyx.techapi.elyx.techwss://ws.elyx.tech

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/index.js logs accessToken and refreshToken during setup, but only to local Logger and no exfil path was found.
dist/export-project.js and CLI files read JWT env vars/.env.test and write user-requested export/test files.

Evidence against

package.json has no preinstall/install/postinstall hooks and main is dist/index.js.
dist/config.js contains publishable Stripe/Google/AWS Cognito client IDs and Elyx service URLs, not private secrets.
Network use in dist/index.js is package-aligned API/websocket access to Elyx editor/publishing services with caller-provided tokens.
No child_process, eval/vm/Function, native binary loading, persistence, destructive behavior, or AI-agent config mutation found.
dist/export-project-cli.js and dist/create-test-cli.js are explicit user-invoked scripts, not lifecycle execution.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 167 KB of source, external domains: api.dev.elyx.tech, api.elyx.tech, api.staging.elyx.tech, app.nango.dev, billing.stripe.com, connect.dev.elyx.tech, connect.elyx.tech, d2i41032bsu0o2.cloudfront.net, d3meuwyksvik3l.cloudfront.net, df2h57ytbvezp.cloudfront.net, elyx-dev-help-articles.s3.eu-central-1.amazonaws.com, elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com, elyx-prod-help-articles.s3.eu-central-1.amazonaws.com, elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com, elyx-staging-help-articles.s3.eu-central-1.amazonaws.com, integrations.dev.elyx.tech, integrations.elyx.tech, ws.dev.elyx.tech

Source & flagged code

4 flagged

dist/config.jsView file

Lines 20-116javascript

20 aws_cognito_signup_attributes: ['EMAIL'],

21 aws_cognito_password_protection_settings: {

22 passwordPolicyMinLength: 8,

23 passwordPolicyCharacters: [

24 'REQUIRES_LOWERCASE',

25 'REQUIRES_UPPERCASE',

26 'REQUIRES_NUMBERS',

27 'REQUIRES_SYMBOLS',

28 ],

29 },

30 aws_cognito_verification_mechanisms: ['EMAIL'],

31 },

32 HELP_ARTICLES_URL: 'https://elyx-dev-help-articles.s3.eu-central-1.amazonaws.com',

33 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

34 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

35 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

36 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

37 HTTP_CLIENT_URL: 'https://df2h57ytbvezp.cloudfront.net',

38 EDITOR_RUNTIME_IP_ADDRESS: '35.157.54.29',

39 GOOGLE_PICKER_APP_ID: '5729685821',

40 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

41 },

42 staging: {

43 stripe_publishable_key: 'pk_test_rYj0t30AfihMVtTZQA2HjjuT',

44 stripe_pricing_table_id: 'prctbl_1TREcAFUJjMj5cqLEALlJZfX',

45 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/test_5kQ5kDftobJmdMvczqgbm00',

46 stripe_org_sub_mngmt_url: '',

47 API_BASE_URL: 'https://api.staging.elyx.tech', // Future staging API

48 WS_URL: 'wss://ws.staging.elyx.tech',

49 amplifyConfig: {

50 aws_project_region: 'eu-central-1',

51 aws_cognito_region: 'eu-central-1',

52 aws_user_pools_id: 'eu-central-1_Hqy56jrad', // Your Staging User Pool ID

53 aws_user_pools_web_client_id: '3p75u41s5b32okj31hr2lvqcer', // Your Staging Client ID

54 aws_cognito_username_attributes: ['EMAIL'],

55 aws_cognito_signup_attributes: ['EMAIL'],

56 aws_cognito_password_protection_settings: {

57 passwordPolicyMinLength: 8,

58 passwordPolicyCharacters: [

59 'REQUIRES_LOWERCASE',

60 'REQUIRES_UPPERCASE',

61 'REQUIRES_NUMBERS',

62 'REQUIRES_SYMBOLS',

63 ],

64 },

65 aws_cognito_verification_mechanisms: ['EMAIL'],

66 },

67 HELP_ARTICLES_URL: 'https://elyx-staging-help-articles.s3.eu-central-1.amazonaws.com',

68 // External integrations for staging share the 'dev' environments resources

69 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

70 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

71 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

72 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

73 HTTP_CLIENT_URL: 'https://d2i41032bsu0o2.cloudfront.net',

74 EDITOR_RUNTIME_IP_ADDRESS: '63.182.186.122',

75 GOOGLE_PICKER_APP_ID: '5729685821',

76 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

77 },

78 prod: {

79 stripe_publishable_key: 'pk_live_HrFGNCp9YrKECgyAh5f4JMZO',

80 stripe_pricing_table_id: 'prctbl_1TRDRIFUJjMj5cqLss0ervUw',

81 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/5kQ5kDftobJmdMvczqgbm00',

82 stripe_org_sub_mngmt_url: '',

83 API_BASE_URL: 'https://api.elyx.tech',

84 WS_URL: 'wss://ws.elyx.tech',

85 amplifyConfig: {

86 aws_project_region: 'eu-central-1',

87 aws_cognito_region: 'eu-central-1',

88 aws_user_pools_id: 'eu-central-1_MzPRdm914',

89 aws_user_pools_web_client_id: '4hejvd5qnn2dhit4trd9kdcb2u',

90 aws_cognito_username_attributes: ['EMAIL'],

91 aws_cognito_signup_attributes: ['EMAIL'],

92 aws_cognito_password_protection_settings: {

93 passwordPolicyMinLength: 8,

94 passwordPolicyCharacters: [

95 'REQUIRES_LOWERCASE',

96 'REQUIRES_UPPERCASE',

97 'REQUIRES_NUMBERS',

98 'REQUIRES_SYMBOLS',

99 ],

100 },

101 aws_cognito_verification_mechanisms: ['EMAIL'],

102 },

103 HELP_ARTICLES_URL: 'https://elyx-prod-help-articles.s3.eu-central-1.amazonaws.com',

104 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com',

105 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.elyx.tech',

106 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.elyx.tech',

107 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

108 HTTP_CLIENT_URL: 'https://d3meuwyksvik3l.cloudfront.net',

109 EDITOR_RUNTIME_IP_ADDRESS: '3.76.93.206',

110 GOOGLE_PICKER_APP_ID: '5729685821',

111 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

112 },

113};

114// Fallback to dev if something goes weird

115exports.envConfig = environments[ENV] || environments.dev;

116

Source & flagged code

4 flagged · loading source

dist/config.jsView file

40patternName = google_api_key severity = high line = 40 matchedText = GOOGLE_P...EA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

40patternName = google_api_key severity = high line = 40 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

76patternName = google_api_key severity = high line = 76 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

111patternName = google_api_key severity = high line = 111 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

Findings

4 High2 Medium4 Low

HighHigh Secretdist/config.js

HighSecret Patterndist/config.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/config.jsView file

Lines 20-116javascript

20 aws_cognito_signup_attributes: ['EMAIL'],

21 aws_cognito_password_protection_settings: {

22 passwordPolicyMinLength: 8,

23 passwordPolicyCharacters: [

24 'REQUIRES_LOWERCASE',

25 'REQUIRES_UPPERCASE',

26 'REQUIRES_NUMBERS',

27 'REQUIRES_SYMBOLS',

28 ],

29 },

30 aws_cognito_verification_mechanisms: ['EMAIL'],

31 },

32 HELP_ARTICLES_URL: 'https://elyx-dev-help-articles.s3.eu-central-1.amazonaws.com',

33 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

34 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

35 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

36 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

37 HTTP_CLIENT_URL: 'https://df2h57ytbvezp.cloudfront.net',

38 EDITOR_RUNTIME_IP_ADDRESS: '35.157.54.29',

39 GOOGLE_PICKER_APP_ID: '5729685821',

40 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

41 },

42 staging: {

43 stripe_publishable_key: 'pk_test_rYj0t30AfihMVtTZQA2HjjuT',

44 stripe_pricing_table_id: 'prctbl_1TREcAFUJjMj5cqLEALlJZfX',

45 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/test_5kQ5kDftobJmdMvczqgbm00',

46 stripe_org_sub_mngmt_url: '',

47 API_BASE_URL: 'https://api.staging.elyx.tech', // Future staging API

48 WS_URL: 'wss://ws.staging.elyx.tech',

49 amplifyConfig: {

50 aws_project_region: 'eu-central-1',

51 aws_cognito_region: 'eu-central-1',

52 aws_user_pools_id: 'eu-central-1_Hqy56jrad', // Your Staging User Pool ID

53 aws_user_pools_web_client_id: '3p75u41s5b32okj31hr2lvqcer', // Your Staging Client ID

54 aws_cognito_username_attributes: ['EMAIL'],

55 aws_cognito_signup_attributes: ['EMAIL'],

56 aws_cognito_password_protection_settings: {

57 passwordPolicyMinLength: 8,

58 passwordPolicyCharacters: [

59 'REQUIRES_LOWERCASE',

60 'REQUIRES_UPPERCASE',

61 'REQUIRES_NUMBERS',

62 'REQUIRES_SYMBOLS',

63 ],

64 },

65 aws_cognito_verification_mechanisms: ['EMAIL'],

66 },

67 HELP_ARTICLES_URL: 'https://elyx-staging-help-articles.s3.eu-central-1.amazonaws.com',

68 // External integrations for staging share the 'dev' environments resources

69 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

70 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

71 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

72 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

73 HTTP_CLIENT_URL: 'https://d2i41032bsu0o2.cloudfront.net',

74 EDITOR_RUNTIME_IP_ADDRESS: '63.182.186.122',

75 GOOGLE_PICKER_APP_ID: '5729685821',

76 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

77 },

78 prod: {

79 stripe_publishable_key: 'pk_live_HrFGNCp9YrKECgyAh5f4JMZO',

80 stripe_pricing_table_id: 'prctbl_1TRDRIFUJjMj5cqLss0ervUw',

81 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/5kQ5kDftobJmdMvczqgbm00',

82 stripe_org_sub_mngmt_url: '',

83 API_BASE_URL: 'https://api.elyx.tech',

84 WS_URL: 'wss://ws.elyx.tech',

85 amplifyConfig: {

86 aws_project_region: 'eu-central-1',

87 aws_cognito_region: 'eu-central-1',

88 aws_user_pools_id: 'eu-central-1_MzPRdm914',

89 aws_user_pools_web_client_id: '4hejvd5qnn2dhit4trd9kdcb2u',

90 aws_cognito_username_attributes: ['EMAIL'],

91 aws_cognito_signup_attributes: ['EMAIL'],

92 aws_cognito_password_protection_settings: {

93 passwordPolicyMinLength: 8,

94 passwordPolicyCharacters: [

95 'REQUIRES_LOWERCASE',

96 'REQUIRES_UPPERCASE',

97 'REQUIRES_NUMBERS',

98 'REQUIRES_SYMBOLS',

99 ],

100 },

101 aws_cognito_verification_mechanisms: ['EMAIL'],

102 },

103 HELP_ARTICLES_URL: 'https://elyx-prod-help-articles.s3.eu-central-1.amazonaws.com',

104 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com',

105 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.elyx.tech',

106 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.elyx.tech',

107 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

108 HTTP_CLIENT_URL: 'https://d3meuwyksvik3l.cloudfront.net',

109 EDITOR_RUNTIME_IP_ADDRESS: '3.76.93.206',

110 GOOGLE_PICKER_APP_ID: '5729685821',

111 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

112 },

113};

114// Fallback to dev if something goes weird

115exports.envConfig = environments[ENV] || environments.dev;

116