@finos/legend-application-marketplace@0.5.8
Legend Marketplace application core
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged stylesheet contains a BOM and conventional minified UI styles, with no Trojan Source controls or external resource references found. The package entry point and scripts show ordinary application exports and build tooling, with no malicious behavior identified.
Decision evidence
public snapshot- The package exports a JavaScript module and stylesheet; its entry point re-exports marketplace application modules.
- The package scripts shown are build, development, lint, and test commands; no install hook is declared.
- The flagged stylesheet begins with a BOM followed by ordinary minified UI styles; no bidi control characters or external resource references were found.
- Telemetry calls are tied to marketplace UI events and use the application telemetry service.
Source & flagged code
7 flaggedSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
lib/index.cssView on unpkg · L17A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/index.cssView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
Affected versions and remediation
This report applies to @finos/legend-application-marketplace@0.5.8.
See all versions of @finos/legend-application-marketplace for other recorded verdicts.
- Review the evidence and your use of @finos/legend-application-marketplace@0.5.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.