registry / @lobehub/editor / 4.20.1

@lobehub/editor@4.20.1

⚠ Under review

A powerful and extensible rich text editor built on Meta's Lexical framework, providing a modern editing experience with React integration.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 296 file(s), 1.16 MB of source, external domains: registry.npmmirror.com, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 39-89json

39 "import": "./es/plugins/litexml/command/symbols.js"

40 },

41 "./react": {

42 "types": "./es/react.d.ts",

43 "import": "./es/react.js"

44 },

45 "./renderer": {

46 "types": "./es/renderer.d.ts",

47 "import": "./es/renderer.js"

48 },

49 "./package.json": "./package.json"

50 },

51 "main": "./es/index.js",

52 "module": "./es/index.js",

53 "types": "./es/index.d.ts",

54 "files": [

55 "es",

56 "patches",

57 "scripts/postinstall-lexical-patch.cjs"

58 ],

59 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L59

60 "build": "tsdown",

61 "build:clean": "tsx ./scripts/clean.ts",

62 "build:watch": "tsdown --watch",

63 "ci": "npm run lint:circular && npm run lint && npm run type-check",

64 "clean": "rm -r es lib dist coverage .dumi/tmp .eslintcache node_modules/.cache",

65 "dev": "dumi dev",

66 "docs:build": "dumi build",

67 "docs:build-analyze": "ANALYZE=1 dumi build",

68 "docs:dev": "dumi dev",

69 "postinstall": "node ./scripts/postinstall-lexical-patch.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

70 "lint": "eslint \"{src,tests}/**/*.{js,jsx,ts,tsx}\" --fix",

71 "lint:circular": "dpdm src/**/*.{ts,tsx} --warning false --tree false --exit-code circular:1 -T true",

72 "lint:md": "remark . --quiet --frail --output",

73 "lint:style": "stylelint \"{src,tests}/**/*.{js,jsx,ts,tsx,less}\" --fix",

74 "prepack": "clean-package",

75 "postpack": "clean-package restore",

76 "prepare": "husky && npm run setup",

77 "prettier": "prettier -c --write --no-error-on-unmatched-pattern \"**/**\"",

78 "release": "semantic-release",

79 "setup": "dumi setup",

80 "start": "npm run docs:dev",

81 "test": "vitest",

82 "test:coverage": "vitest run --coverage --passWithNoTests",

83 "test:watch": "vitest --watch",

84 "type-check": "tsc --noEmit"

85 },

86 "dependencies": {

87 "@floating-ui/dom": "^1.7.4",

88 "@floating-ui/react": "^0.27.16",

89 "@lexical/clipboard": "0.42.0",

es/plugins/code/plugin/index.jsView file

Lines 27-67javascript

27 this.register(editor.registerNodeTransform(TextNode, (node) => {

28 if (node.hasFormat("code")) node.replace($createCodeNode(node.getTextContent())).insertAfter($createCursorNode());

29 }));

30 this.registerMarkdown

es/headless.jsView file

•Trigger-reachable chain: manifest.exports -> es/headless.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

es/headless.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•devDependencies registry_only=@commitlint/cli,@emotion/is-prop-valid,@lobehub/lint,@lobehub/ui,@shikijs/types,@types/debug,@types/katex,@types/mdast

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall-lexical-patch.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

es/plugins/code/plugin/index.jsView file

47contains invisible/control Unicode U+FEFF (zero width no-break space) ctx.appendLine(`\`${node.getTextContent().replaceAll("<U+FEFF>", "")}\``);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

es/plugins/code/plugin/index.jsView on unpkg · L47

es/headless.jsView file

•Trigger-reachable chain: manifest.exports -> es/headless.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

es/headless.jsView on unpkg

Findings

3 Critical1 High2 Medium5 Low

CriticalTrojan Source Unicodees/plugins/code/plugin/index.js

CriticalTrigger Reachable Dangerous Capabilityes/headless.js

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 39-89json

39 "import": "./es/plugins/litexml/command/symbols.js"

40 },

41 "./react": {

42 "types": "./es/react.d.ts",

43 "import": "./es/react.js"

44 },

45 "./renderer": {

46 "types": "./es/renderer.d.ts",

47 "import": "./es/renderer.js"

48 },

49 "./package.json": "./package.json"

50 },

51 "main": "./es/index.js",

52 "module": "./es/index.js",

53 "types": "./es/index.d.ts",

54 "files": [

55 "es",

56 "patches",

57 "scripts/postinstall-lexical-patch.cjs"

58 ],

59 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L59

60 "build": "tsdown",

61 "build:clean": "tsx ./scripts/clean.ts",

62 "build:watch": "tsdown --watch",

63 "ci": "npm run lint:circular && npm run lint && npm run type-check",

64 "clean": "rm -r es lib dist coverage .dumi/tmp .eslintcache node_modules/.cache",

65 "dev": "dumi dev",

66 "docs:build": "dumi build",

67 "docs:build-analyze": "ANALYZE=1 dumi build",

68 "docs:dev": "dumi dev",

69 "postinstall": "node ./scripts/postinstall-lexical-patch.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

70 "lint": "eslint \"{src,tests}/**/*.{js,jsx,ts,tsx}\" --fix",

71 "lint:circular": "dpdm src/**/*.{ts,tsx} --warning false --tree false --exit-code circular:1 -T true",

72 "lint:md": "remark . --quiet --frail --output",

73 "lint:style": "stylelint \"{src,tests}/**/*.{js,jsx,ts,tsx,less}\" --fix",

74 "prepack": "clean-package",

75 "postpack": "clean-package restore",

76 "prepare": "husky && npm run setup",

77 "prettier": "prettier -c --write --no-error-on-unmatched-pattern \"**/**\"",

78 "release": "semantic-release",

79 "setup": "dumi setup",

80 "start": "npm run docs:dev",

81 "test": "vitest",

82 "test:coverage": "vitest run --coverage --passWithNoTests",

83 "test:watch": "vitest --watch",

84 "type-check": "tsc --noEmit"

85 },

86 "dependencies": {

87 "@floating-ui/dom": "^1.7.4",

88 "@floating-ui/react": "^0.27.16",

89 "@lexical/clipboard": "0.42.0",

es/plugins/code/plugin/index.jsView file

Lines 27-67javascript

27 this.register(editor.registerNodeTransform(TextNode, (node) => {

28 if (node.hasFormat("code")) node.replace($createCodeNode(node.getTextContent())).insertAfter($createCursorNode());

29 }));

30 this.registerMarkdown

es/headless.jsView file

•Trigger-reachable chain: manifest.exports -> es/headless.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

es/headless.jsView on unpkg