registry / @elyx-code/editor-nodejs / 0.0.1358

@elyx-code/editor-nodejs@0.0.1358

An installable package of a headless serverside version of the project's editor logic for a NodeJS environment

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a headless Elyx editor client that contacts Elyx service endpoints when users instantiate/setup the editor or run export/test helper CLIs.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime use of Editor methods or explicit export/create-test CLI execution with project credentials.

Impact

Authenticated project data may be fetched/exported to a user-selected local path by intended commands; no unconsented install-time behavior found.

Mechanism

package-aligned API/websocket client and explicit file export helpers

Rationale

Static inspection found suspicious-looking network, token, and key patterns, but they are consistent with an authenticated editor SDK and explicit export tooling, with no lifecycle hooks or covert execution path. No credential harvesting, exfiltration to unrelated hosts, persistence, destructive behavior, or AI-agent control mutation was found.

Evidence

package.jsondist/config.jsdist/index.jsdist/export-project.jsdist/export-project-cli.jsdist/create-test-cli.jsdist/modules/uuid.jsdist/test-instance.jsdist/export-project.js writes exported JSON to options.outDir/default repo rootdist/create-test-cli.js writes generated test boilerplate to options.outDir/default project-logic-tree path

Network endpoints10

api.dev.elyx.techws.dev.elyx.techapi.staging.elyx.techwss://ws.staging.elyx.techapi.elyx.techwss://ws.elyx.techintegrations.dev.elyx.techconnect.dev.elyx.techintegrations.elyx.techconnect.elyx.tech

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/config.js embeds public service configuration including Stripe publishable keys, Cognito client IDs, and a Google Picker API key.
dist/export-project.js and dist/create-test-cli.js can write exported project/test files when explicitly invoked with credentials.

Evidence against

package.json has no preinstall/install/postinstall hooks and no bin entries.
dist/index.js exports Editor/ProjectFetch classes; network calls occur from constructors/setup/methods for the declared headless editor client.
Network use is package-aligned: Elyx API/websocket/publishing endpoints and configured S3/Stripe/Nango URLs in dist/config.js.
No child_process, eval/vm/Function, native binary loading, persistence, destructive filesystem actions, or AI-agent control-surface writes found.
Environment variables are limited to APP_ENV and explicit JWT/user/npm config inputs for user-run export/test tooling.
Filesystem writes are explicit CLI outputs via fs.writeFileSync/mkdirSync, not install-time or import-time behavior.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 167 KB of source, external domains: api.dev.elyx.tech, api.elyx.tech, api.staging.elyx.tech, app.nango.dev, billing.stripe.com, connect.dev.elyx.tech, connect.elyx.tech, d2i41032bsu0o2.cloudfront.net, d3meuwyksvik3l.cloudfront.net, df2h57ytbvezp.cloudfront.net, elyx-dev-help-articles.s3.eu-central-1.amazonaws.com, elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com, elyx-prod-help-articles.s3.eu-central-1.amazonaws.com, elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com, elyx-staging-help-articles.s3.eu-central-1.amazonaws.com, integrations.dev.elyx.tech, integrations.elyx.tech, ws.dev.elyx.tech

Source & flagged code

4 flagged

dist/config.jsView file

Lines 20-116javascript

20 aws_cognito_signup_attributes: ['EMAIL'],

21 aws_cognito_password_protection_settings: {

22 passwordPolicyMinLength: 8,

23 passwordPolicyCharacters: [

24 'REQUIRES_LOWERCASE',

25 'REQUIRES_UPPERCASE',

26 'REQUIRES_NUMBERS',

27 'REQUIRES_SYMBOLS',

28 ],

29 },

30 aws_cognito_verification_mechanisms: ['EMAIL'],

31 },

32 HELP_ARTICLES_URL: 'https://elyx-dev-help-articles.s3.eu-central-1.amazonaws.com',

33 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

34 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

35 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

36 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

37 HTTP_CLIENT_URL: 'https://df2h57ytbvezp.cloudfront.net',

38 EDITOR_RUNTIME_IP_ADDRESS: '35.157.54.29',

39 GOOGLE_PICKER_APP_ID: '5729685821',

40 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

41 },

42 staging: {

43 stripe_publishable_key: 'pk_test_rYj0t30AfihMVtTZQA2HjjuT',

44 stripe_pricing_table_id: 'prctbl_1TREcAFUJjMj5cqLEALlJZfX',

45 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/test_5kQ5kDftobJmdMvczqgbm00',

46 stripe_org_sub_mngmt_url: '',

47 API_BASE_URL: 'https://api.staging.elyx.tech', // Future staging API

48 WS_URL: 'wss://ws.staging.elyx.tech',

49 amplifyConfig: {

50 aws_project_region: 'eu-central-1',

51 aws_cognito_region: 'eu-central-1',

52 aws_user_pools_id: 'eu-central-1_Hqy56jrad', // Your Staging User Pool ID

53 aws_user_pools_web_client_id: '3p75u41s5b32okj31hr2lvqcer', // Your Staging Client ID

54 aws_cognito_username_attributes: ['EMAIL'],

55 aws_cognito_signup_attributes: ['EMAIL'],

56 aws_cognito_password_protection_settings: {

57 passwordPolicyMinLength: 8,

58 passwordPolicyCharacters: [

59 'REQUIRES_LOWERCASE',

60 'REQUIRES_UPPERCASE',

61 'REQUIRES_NUMBERS',

62 'REQUIRES_SYMBOLS',

63 ],

64 },

65 aws_cognito_verification_mechanisms: ['EMAIL'],

66 },

67 HELP_ARTICLES_URL: 'https://elyx-staging-help-articles.s3.eu-central-1.amazonaws.com',

68 // External integrations for staging share the 'dev' environments resources

69 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

70 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

71 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

72 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

73 HTTP_CLIENT_URL: 'https://d2i41032bsu0o2.cloudfront.net',

74 EDITOR_RUNTIME_IP_ADDRESS: '63.182.186.122',

75 GOOGLE_PICKER_APP_ID: '5729685821',

76 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

77 },

78 prod: {

79 stripe_publishable_key: 'pk_live_HrFGNCp9YrKECgyAh5f4JMZO',

80 stripe_pricing_table_id: 'prctbl_1TRDRIFUJjMj5cqLss0ervUw',

81 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/5kQ5kDftobJmdMvczqgbm00',

82 stripe_org_sub_mngmt_url: '',

83 API_BASE_URL: 'https://api.elyx.tech',

84 WS_URL: 'wss://ws.elyx.tech',

85 amplifyConfig: {

86 aws_project_region: 'eu-central-1',

87 aws_cognito_region: 'eu-central-1',

88 aws_user_pools_id: 'eu-central-1_MzPRdm914',

89 aws_user_pools_web_client_id: '4hejvd5qnn2dhit4trd9kdcb2u',

90 aws_cognito_username_attributes: ['EMAIL'],

91 aws_cognito_signup_attributes: ['EMAIL'],

92 aws_cognito_password_protection_settings: {

93 passwordPolicyMinLength: 8,

94 passwordPolicyCharacters: [

95 'REQUIRES_LOWERCASE',

96 'REQUIRES_UPPERCASE',

97 'REQUIRES_NUMBERS',

98 'REQUIRES_SYMBOLS',

99 ],

100 },

101 aws_cognito_verification_mechanisms: ['EMAIL'],

102 },

103 HELP_ARTICLES_URL: 'https://elyx-prod-help-articles.s3.eu-central-1.amazonaws.com',

104 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com',

105 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.elyx.tech',

106 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.elyx.tech',

107 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

108 HTTP_CLIENT_URL: 'https://d3meuwyksvik3l.cloudfront.net',

109 EDITOR_RUNTIME_IP_ADDRESS: '3.76.93.206',

110 GOOGLE_PICKER_APP_ID: '5729685821',

111 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

112 },

113};

114// Fallback to dev if something goes weird

115exports.envConfig = environments[ENV] || environments.dev;

116

Source & flagged code

4 flagged · loading source

dist/config.jsView file

40patternName = google_api_key severity = high line = 40 matchedText = GOOGLE_P...EA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

40patternName = google_api_key severity = high line = 40 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

76patternName = google_api_key severity = high line = 76 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

111patternName = google_api_key severity = high line = 111 matchedText = GOOGLE_P...EA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

Findings

4 High2 Medium4 Low

HighHigh Secretdist/config.js

HighSecret Patterndist/config.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/config.jsView file

Lines 20-116javascript

20 aws_cognito_signup_attributes: ['EMAIL'],

21 aws_cognito_password_protection_settings: {

22 passwordPolicyMinLength: 8,

23 passwordPolicyCharacters: [

24 'REQUIRES_LOWERCASE',

25 'REQUIRES_UPPERCASE',

26 'REQUIRES_NUMBERS',

27 'REQUIRES_SYMBOLS',

28 ],

29 },

30 aws_cognito_verification_mechanisms: ['EMAIL'],

31 },

32 HELP_ARTICLES_URL: 'https://elyx-dev-help-articles.s3.eu-central-1.amazonaws.com',

33 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

34 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

35 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

36 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

37 HTTP_CLIENT_URL: 'https://df2h57ytbvezp.cloudfront.net',

38 EDITOR_RUNTIME_IP_ADDRESS: '35.157.54.29',

39 GOOGLE_PICKER_APP_ID: '5729685821',

40 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

High Secret

Package contains a high-severity secret pattern.

dist/config.jsView on unpkg · L40

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L40

41 },

42 staging: {

43 stripe_publishable_key: 'pk_test_rYj0t30AfihMVtTZQA2HjjuT',

44 stripe_pricing_table_id: 'prctbl_1TREcAFUJjMj5cqLEALlJZfX',

45 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/test_5kQ5kDftobJmdMvczqgbm00',

46 stripe_org_sub_mngmt_url: '',

47 API_BASE_URL: 'https://api.staging.elyx.tech', // Future staging API

48 WS_URL: 'wss://ws.staging.elyx.tech',

49 amplifyConfig: {

50 aws_project_region: 'eu-central-1',

51 aws_cognito_region: 'eu-central-1',

52 aws_user_pools_id: 'eu-central-1_Hqy56jrad', // Your Staging User Pool ID

53 aws_user_pools_web_client_id: '3p75u41s5b32okj31hr2lvqcer', // Your Staging Client ID

54 aws_cognito_username_attributes: ['EMAIL'],

55 aws_cognito_signup_attributes: ['EMAIL'],

56 aws_cognito_password_protection_settings: {

57 passwordPolicyMinLength: 8,

58 passwordPolicyCharacters: [

59 'REQUIRES_LOWERCASE',

60 'REQUIRES_UPPERCASE',

61 'REQUIRES_NUMBERS',

62 'REQUIRES_SYMBOLS',

63 ],

64 },

65 aws_cognito_verification_mechanisms: ['EMAIL'],

66 },

67 HELP_ARTICLES_URL: 'https://elyx-staging-help-articles.s3.eu-central-1.amazonaws.com',

68 // External integrations for staging share the 'dev' environments resources

69 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-dev-public-external-integrations.s3.eu-central-1.amazonaws.com',

70 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.dev.elyx.tech',

71 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.dev.elyx.tech',

72 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

73 HTTP_CLIENT_URL: 'https://d2i41032bsu0o2.cloudfront.net',

74 EDITOR_RUNTIME_IP_ADDRESS: '63.182.186.122',

75 GOOGLE_PICKER_APP_ID: '5729685821',

76 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L76

77 },

78 prod: {

79 stripe_publishable_key: 'pk_live_HrFGNCp9YrKECgyAh5f4JMZO',

80 stripe_pricing_table_id: 'prctbl_1TRDRIFUJjMj5cqLss0ervUw',

81 stripe_personal_sub_mngmt_url: 'https://billing.stripe.com/p/login/5kQ5kDftobJmdMvczqgbm00',

82 stripe_org_sub_mngmt_url: '',

83 API_BASE_URL: 'https://api.elyx.tech',

84 WS_URL: 'wss://ws.elyx.tech',

85 amplifyConfig: {

86 aws_project_region: 'eu-central-1',

87 aws_cognito_region: 'eu-central-1',

88 aws_user_pools_id: 'eu-central-1_MzPRdm914',

89 aws_user_pools_web_client_id: '4hejvd5qnn2dhit4trd9kdcb2u',

90 aws_cognito_username_attributes: ['EMAIL'],

91 aws_cognito_signup_attributes: ['EMAIL'],

92 aws_cognito_password_protection_settings: {

93 passwordPolicyMinLength: 8,

94 passwordPolicyCharacters: [

95 'REQUIRES_LOWERCASE',

96 'REQUIRES_UPPERCASE',

97 'REQUIRES_NUMBERS',

98 'REQUIRES_SYMBOLS',

99 ],

100 },

101 aws_cognito_verification_mechanisms: ['EMAIL'],

102 },

103 HELP_ARTICLES_URL: 'https://elyx-prod-help-articles.s3.eu-central-1.amazonaws.com',

104 PUBLIC_EXTERNAL_INTEGRATIONS_URL: 'https://elyx-prod-public-external-integrations.s3.eu-central-1.amazonaws.com',

105 EXTERNAL_INTEGRATIONS_URL: 'https://integrations.elyx.tech',

106 EXTERNAL_INTEGRATIONS_CONNECT_URL: 'https://connect.elyx.tech',

107 EXTERNAL_INTEGRATIONS_LOGOS_URL: 'https://app.nango.dev/images/template-logos',

108 HTTP_CLIENT_URL: 'https://d3meuwyksvik3l.cloudfront.net',

109 EDITOR_RUNTIME_IP_ADDRESS: '3.76.93.206',

110 GOOGLE_PICKER_APP_ID: '5729685821',

111 GOOGLE_PICKER_API_KEY: 'AIzaSyCifEH3gMsOsOCaHMeQbGafHKlQSPUEmEA',

High

Secret Pattern

Google API key in dist/config.js

dist/config.jsView on unpkg · L111

112 },

113};

114// Fallback to dev if something goes weird

115exports.envConfig = environments[ENV] || environments.dev;

116