registry  /  @laikacms/decap-cms  /  4.0.1

@laikacms/decap-cms@4.0.1

Single-package fork of Decap CMS v4.beta. Same components as the original monorepo, exposed through one package with subpath exports. Root export is the decap-cms-app bootstrap. See RESTRUCTURE.md.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The optional local proxy can edit a configured CMS repository only when explicitly run by the integrator.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit import/start of the `./server` export and requests to its local API.
Impact
No install-time execution, credential harvesting, remote payload loading, or AI-agent control-surface mutation established.
Mechanism
CMS backend integration and scoped repository content management.
Rationale
Static hints are false positives: the bidi file is an anti-Trojan-Source utility, and the observed network/file capabilities align with an explicitly run CMS and its optional local repository proxy. Source inspection found no malicious execution chain.
Evidence
package.jsondist/lib/widgets/bidiControls.jsdist/server/index.jsdist/server/middlewares/localFs/index.jsdist/server/middlewares/localGit/index.jsdist/server/middlewares/utils/fs.jsdist/app/index.jsdist/server/middlewares/common/index.jsdist/core/hooks/useLocalBackup.js

Decision evidence

public snapshot
AI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • `package.json` has no npm lifecycle hooks or bin entrypoint.
    • `dist/lib/widgets/bidiControls.js` detects and visualizes bidi controls; it does not hide or execute payloads.
    • No `child_process`, `eval`, or `Function` use was found in shipped JS.
    • `dist/server/index.js` is an explicitly imported proxy server, not a package install/import side effect.
    • Local file writes in `dist/server/middlewares` are CMS operations scoped to the configured repository path.
    Behavioral surface
    Source
    ChildProcessCryptoEnvironmentVarsFilesystemNetwork
    Supply chain
    HighEntropyStringsMinifiedUrlStrings
    ManifestNo manifest risk signals triggered.
    scanned 443 file(s), 6.40 MB of source, external domains: api.bitbucket.org, api.github.com, api.netlify.com, app.vssps.visualstudio.com, bitbucket.org, bitbucket.status.atlassian.com, dev.azure.com, docs.netlify.com, example.com, git-lfs.github.com, github.com, gitlab.com, login.microsoftonline.com, media-library.cloudinary.com, try.gitea.io, ucarecdn.com, www.decapcms.org, www.githubstatus.com, www.netlifystatus.com, www.w3.org

    Source & flagged code

    34 flagged · loading source
    dist/locales/sl/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...o.',
    Medium
    Secret Pattern

    Package contains a possible secret pattern.

    dist/locales/sl/index.jsView on unpkg · L12
    dist/lib/widgets/bidiControls.jsView file
    88contains invisible/control Unicode U+202E (right-to-left override) * visible named form, e.g. `"admin<U+202E>txt.exe"` -> `"admin<RLO>txt.exe"`.
    Critical
    Trojan Source Unicode

    Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

    dist/lib/widgets/bidiControls.jsView on unpkg · L88
    •Trigger-reachable chain: manifest.exports -> dist/lib/widgets/index.js -> dist/lib/widgets/bidiControls.js Reachable file contains a blocking source-risk pattern.
    Critical
    Trigger Reachable Dangerous Capability

    A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

    dist/lib/widgets/bidiControls.jsView on unpkg
    dist/locales/pl/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...ło',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/pl/index.js

    dist/locales/pl/index.jsView on unpkg · L13
    dist/locales/vi/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...n.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/vi/index.js

    dist/locales/vi/index.jsView on unpkg · L12
    dist/locales/ua/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...ь.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/ua/index.js

    dist/locales/ua/index.jsView on unpkg · L13
    dist/locales/sv/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...d.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/sv/index.js

    dist/locales/sv/index.jsView on unpkg · L13
    dist/locales/he/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...ה.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/he/index.js

    dist/locales/he/index.jsView on unpkg · L13
    dist/locales/da/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...d.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/da/index.js

    dist/locales/da/index.jsView on unpkg · L13
    dist/locales/gr/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...ς.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/gr/index.js

    dist/locales/gr/index.jsView on unpkg · L12
    dist/locales/ja/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...い。',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/ja/index.js

    dist/locales/ja/index.jsView on unpkg · L13
    dist/locales/it/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...d.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/it/index.js

    dist/locales/it/index.jsView on unpkg · L12
    dist/locales/ca/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...a.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/ca/index.js

    dist/locales/ca/index.jsView on unpkg · L12
    dist/locales/nb_no/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...t.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/nb_no/index.js

    dist/locales/nb_no/index.jsView on unpkg · L12
    dist/locales/cs/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...o.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/cs/index.js

    dist/locales/cs/index.jsView on unpkg · L13
    dist/locales/ru/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...ь.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/ru/index.js

    dist/locales/ru/index.jsView on unpkg · L13
    dist/locales/zh_Hant/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...碼。',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/zh_Hant/index.js

    dist/locales/zh_Hant/index.jsView on unpkg · L12
    dist/locales/ro/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...a.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/ro/index.js

    dist/locales/ro/index.jsView on unpkg · L13
    dist/locales/pt/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...a.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/pt/index.js

    dist/locales/pt/index.jsView on unpkg · L13
    dist/locales/uk/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...ь.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/uk/index.js

    dist/locales/uk/index.jsView on unpkg · L13
    dist/locales/mk/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...а.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/mk/index.js

    dist/locales/mk/index.jsView on unpkg · L13
    dist/locales/hr/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...u.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/hr/index.js

    dist/locales/hr/index.jsView on unpkg · L13
    dist/locales/nl/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...n.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/nl/index.js

    dist/locales/nl/index.jsView on unpkg · L13
    dist/locales/bg/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...а.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/bg/index.js

    dist/locales/bg/index.jsView on unpkg · L13
    dist/locales/de/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...n.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/de/index.js

    dist/locales/de/index.jsView on unpkg · L13
    dist/locales/ko/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...요.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/ko/index.js

    dist/locales/ko/index.jsView on unpkg · L13
    dist/locales/fr/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...e.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/fr/index.js

    dist/locales/fr/index.jsView on unpkg · L13
    dist/locales/es/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...a.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/es/index.js

    dist/locales/es/index.jsView on unpkg · L12
    dist/locales/en/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...d.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/en/index.js

    dist/locales/en/index.jsView on unpkg · L13
    dist/locales/fa/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...د.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/fa/index.js

    dist/locales/fa/index.jsView on unpkg · L13
    dist/locales/nn_no/index.jsView file
    12patternName = generic_password severity = medium line = 12 matchedText = password...t.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/nn_no/index.js

    dist/locales/nn_no/index.jsView on unpkg · L12
    dist/locales/lt/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...į.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/lt/index.js

    dist/locales/lt/index.jsView on unpkg · L13
    dist/locales/th/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...ุณ',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/th/index.js

    dist/locales/th/index.jsView on unpkg · L13
    dist/locales/tr/index.jsView file
    13patternName = generic_password severity = medium line = 13 matchedText = password...n.',
    Medium
    Secret Pattern

    Hardcoded password in dist/locales/tr/index.js

    dist/locales/tr/index.jsView on unpkg · L13

    Findings

    2 Critical35 Medium4 Low
    CriticalTrojan Source Unicodedist/lib/widgets/bidiControls.js
    CriticalTrigger Reachable Dangerous Capabilitydist/lib/widgets/bidiControls.js
    MediumSecret Patterndist/locales/sl/index.js
    MediumNetwork
    MediumEnvironment Vars
    MediumStructural Risk Force Deep Review
    MediumSecret Patterndist/locales/pl/index.js
    MediumSecret Patterndist/locales/vi/index.js
    MediumSecret Patterndist/locales/ua/index.js
    MediumSecret Patterndist/locales/sv/index.js
    MediumSecret Patterndist/locales/he/index.js
    MediumSecret Patterndist/locales/da/index.js
    MediumSecret Patterndist/locales/gr/index.js
    MediumSecret Patterndist/locales/ja/index.js
    MediumSecret Patterndist/locales/it/index.js
    MediumSecret Patterndist/locales/ca/index.js
    MediumSecret Patterndist/locales/nb_no/index.js
    MediumSecret Patterndist/locales/cs/index.js
    MediumSecret Patterndist/locales/ru/index.js
    MediumSecret Patterndist/locales/zh_Hant/index.js
    MediumSecret Patterndist/locales/ro/index.js
    MediumSecret Patterndist/locales/pt/index.js
    MediumSecret Patterndist/locales/uk/index.js
    MediumSecret Patterndist/locales/mk/index.js
    MediumSecret Patterndist/locales/hr/index.js
    MediumSecret Patterndist/locales/nl/index.js
    MediumSecret Patterndist/locales/bg/index.js
    MediumSecret Patterndist/locales/de/index.js
    MediumSecret Patterndist/locales/ko/index.js
    MediumSecret Patterndist/locales/fr/index.js
    MediumSecret Patterndist/locales/es/index.js
    MediumSecret Patterndist/locales/en/index.js
    MediumSecret Patterndist/locales/fa/index.js
    MediumSecret Patterndist/locales/nn_no/index.js
    MediumSecret Patterndist/locales/lt/index.js
    MediumSecret Patterndist/locales/th/index.js
    MediumSecret Patterndist/locales/tr/index.js
    LowScripts Present
    LowFilesystem
    LowHigh Entropy Strings
    LowUrl Strings