registry  /  @kerebron/legacy-compat  /  0.8.2

@kerebron/legacy-compat@0.8.2

Packages from NPM can be directly accessed using https://cdn.jsdelivr.net.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a browser/editor compatibility bundle with user-invoked asset loading and ODT/tree-sitter WASM support.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application imports the library and calls editor/asset-loading APIs.
Impact
No evidence of credential theft, arbitrary command execution, persistence, destructive behavior, or unconsented project writes.
Mechanism
User-configured editor asset loading and local browser state persistence
Rationale
Static source inspection shows suspicious primitives are package-aligned browser/editor features: dynamic WASM asset loading, local dynamic import of bundled glue code, and localStorage for UI state. No concrete malicious behavior or install/import-time attack path was found.
Evidence
package.jsonREADME.mddist/kerebron.jsdist/kerebron.cjsdist/odt_parser.internal-PfZhgDYB.jsdist/odt_parser.internal-DGJtzBJe.cjs
Network endpoints1
cdn.jsdelivr.net

Decision evidence

public snapshot
AI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for block
  • dist/kerebron.js has user-invoked fetch in createAssetLoad for caller-provided asset base
  • dist/kerebron.js dynamically imports local odt_parser.internal-PfZhgDYB.js and instantiates caller-loaded WASM assets
  • dist/kerebron.js uses browser localStorage for editor snapshots/menu order
Evidence against
  • package.json has no lifecycle scripts; main/module point only to dist bundles
  • No child_process, fs file harvesting, process.env, credential collection, or exfiltration endpoints found
  • Network use is asset loading for tree-sitter/ODT WASM and README documents jsdelivr asset bases
  • Bidi/Trojan-source control search found no matches in inspected JS bundles
  • Import-time behavior is library definitions plus benign localStorage hydration, not project mutation
Behavioral surface
Source
ChildProcessEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 8 file(s), 2.21 MB of source, external domains: code.google.com, github.com, prosemirror.net, www.w3.org

Source & flagged code

3 flagged · loading source
dist/kerebron.cjsView file
16contains invisible/control Unicode U+2060 (word joiner) `),r=[],a=0,o=0;for(let e of n)r.push({nodeIdx:t,targetRow:o,targetCol:0,targetPos:a}),o++,a+=e.length+1,t+=e.length+1;return{content:e,rawTextMap:r}}function debounce$1(e,t){let n;return(...r)=>{clearTimeout(n),n=setTimeout(()=>e(...r),t)}
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/kerebron.cjsView on unpkg · L16
•Trigger-reachable chain: manifest.main -> dist/kerebron.cjs Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/kerebron.cjsView on unpkg
26${t}`)}let r=e.clone();try{n=await WebAssembly.compileStreaming(e)}catch(e){console.error(`wasm streaming compile failed:`,e),console.error(`falling back to ArrayBuffer instantiati... L27: ${JSON.stringify(a,null,2)}`),Error(`Language.load failed: no language function found in Wasm file`);return new e(INTERNAL,r[o]())}};async function Module2(moduleArg={}){var module... L28: `)[0],s=o.match(QUERY_WORD_REGEX)?.[0]??``;switch(C._free(r),e){case QueryErrorKind.Syntax:throw new QueryError(QueryErrorKind.Syntax,{suffix:`${a}: '${o}'...`},a,0);case QueryErro...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/kerebron.cjsView on unpkg · L26

Findings

2 Critical2 Medium5 Low
CriticalTrojan Source Unicodedist/kerebron.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/kerebron.cjs
MediumNetwork
MediumStructural Risk Force Deep Review
LowEvaldist/kerebron.cjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings