registry / @inchurch/matcha-components / 22.36.1
@inchurch/matcha-components@22.36.1
[Link to the project](https://bitbucket.org/inradar/design-system/src/master/).
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no install hooks, and the flagged bundle behavior examined is consistent with UI editor functionality and numeric-input validation. No concrete malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When an application renders the page-builder or text-editor component.
Impact
Loads editor functionality; no collection or transmission of credentials or host data was identified.
Mechanism
The page builder loads editor libraries and the text editor loads its assets for use in the browser.
AI rationale
The manifest has no install hooks, and the flagged bundle behavior examined is consistent with UI editor functionality and numeric-input validation. No concrete malicious behavior was identified.
Evidence
fesm2022/inchurch-matcha-components.mjs
Network endpoints2
uicdn.toast.comunpkg.com/matcha-components
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no lifecycle scripts and exposes an Angular component bundle as the package entry point.
- The page builder’s script-loading work is in its ngAfterViewInit lifecycle hook, which runs when that component is rendered.
- The page-builder configuration names Toast UI image-editor scripts and styles, consistent with its editor feature.
- The flagged Cyrillic characters appear in a numeric-input validation regex, where they are checked as input characters.
Evidence against
- The package includes an Angular component bundle, and the flagged behaviors are associated with editor and input components.
- No credential collection, unrelated account action, install-time network activity, or destructive behavior was identified in the reviewed excerpts.
Behavioral surface
ChildProcessDynamicRequireEval
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedassets/page-builder/js/grapesjs-plugin-export.jsView file
1/*! grapesjs-plugin-export - 1.0.11 */
L2: !function(e,t){'object'==typeof exports&&'object'==typeof module?module.exports=t():'function'==typeof define&&define.amd?define([],t):'object'==typeof exports?exports["grapesjs-pl...
L3: //# sourceMappingURL=index.js.map
Medium
Dynamic Require
Package source references dynamic require/import behavior.
assets/page-builder/js/grapesjs-plugin-export.jsView on unpkg · L11/*! grapesjs-plugin-export - 1.0.11 */
L2: !function(e,t){'object'==typeof exports&&'object'==typeof module?module.exports=t():'function'==typeof define&&define.amd?define([],t):'object'==typeof exports?exports["grapesjs-pl...
L3: //# sourceMappingURL=index.js.map
Low
Eval
Package source references a known benign dynamic code generation pattern.
assets/page-builder/js/grapesjs-plugin-export.jsView on unpkg · L1fesm2022/inchurch-matcha-components.mjsView file
Findings
2 Critical1 High2 Medium7 Low
CriticalTrojan Source Unicodefesm2022/inchurch-matcha-components.mjs
CriticalTrigger Reachable Dangerous Capabilityfesm2022/inchurch-matcha-components.mjs
HighSemantic Analysis Limitedpackage.json
MediumDynamic Requireassets/page-builder/js/grapesjs-plugin-export.js
MediumStructural Risk Force Deep Review
LowEvalassets/page-builder/js/grapesjs-plugin-export.js
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencefesm2022/inchurch-matcha-components.mjs
LowAi Review Evidencefesm2022/inchurch-matcha-components.mjs
Affected versions and remediation
This report applies to @inchurch/matcha-components@22.36.1.
See all versions of @inchurch/matcha-components for other recorded verdicts.
- Review the evidence and your use of @inchurch/matcha-components@22.36.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.