registry / @servicetitan/anvil2 / 3.7.1

@servicetitan/anvil2@3.7.1

AI Security Review

scanned 29d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a browser UI library with static component exports; the flagged Unicode is a comment character in bundled editor dependency code.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing UI components at application runtime.

Impact

No credential harvesting, exfiltration, install-time mutation, remote payload execution, or persistence identified.

Mechanism

Static React/UI component modules

Rationale

Direct inspection contradicts the scanner’s malicious label: there are no lifecycle hooks or dangerous execution/exfiltration primitives. The Unicode finding is benign prose in a bundled RichTextEditor dependency comment.

Evidence

package.jsondist/index.jsdist/RichTextEditor-B4ZPAevY.jsdist/RichTextEditor.js

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/RichTextEditor-B4ZPAevY.js contains a zero-width character in a prose API comment.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
dist/index.js is a static UI-component export barrel.
The flagged RichTextEditor bundle contains ProseMirror editor code; the invisible character is in documentation text, not executable control flow.
No fetch, XHR, WebSocket, beacon, eval/Function, child-process, or cookie access was found in published JS.
No executable native/binary artifacts were found.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 282 file(s), 5.38 MB of source, external domains: anvil.servicetitan.com, beta.anvil.servicetitan.com, bugs.chromium.org, code.haverbeke.berlin, data.iana.org, developer.microsoft.com, developer.mozilla.org, drafts.csswg.org, fb.me, floating-ui.com, github.com, motion.dev, prosemirror.net, samthor.au, w3c.github.io, www.servicetitan.com, www.stum.de, www.w3.org, www.youtube-nocookie.com, www.youtube.com

Source & flagged code

2 flagged

dist/RichTextEditor-B4ZPAevY.jsView file

2105contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/RichTextEditor-B4ZPAevY.jsView on unpkg · L2105

•Trigger-reachable chain: manifest.exports -> dist/beta.js -> dist/RichTextEditor-B4ZPAevY.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/RichTextEditor-B4ZPAevY.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/RichTextEditor-B4ZPAevY.jsView file

2105contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/RichTextEditor-B4ZPAevY.jsView on unpkg · L2105

•Trigger-reachable chain: manifest.exports -> dist/beta.js -> dist/RichTextEditor-B4ZPAevY.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/RichTextEditor-B4ZPAevY.jsView on unpkg

Findings

2 Critical3 Medium4 Low

CriticalTrojan Source Unicodedist/RichTextEditor-B4ZPAevY.js

CriticalTrigger Reachable Dangerous Capabilitydist/RichTextEditor-B4ZPAevY.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License