registry / @shotstack/shotstack-studio / 2.23.2

@shotstack/shotstack-studio@2.23.2

A video editing library for creating and editing videos with Shotstack

AI Security Review

scanned 9d ago · by lpm-firewall-ai

A WOFF2 font load causes a bundle to fetch a remote JavaScript decompressor and execute it. This establishes a runtime remote-code execution supply-chain surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading a WOFF2 font through the package font loader.

Impact

A compromised, substituted, or otherwise unsafe response from that endpoint can execute code in the consuming application's browser context.

Mechanism

The loader fetches decompressor_binding.js from unpkg.com, converts the response to text, appends a return expression, and passes it to the Function constructor.

AI rationale

The package contains a concrete remote-code execution path in every published runtime bundle. It is a supply-chain vulnerability, not evidence of covert malware intent.

Evidence

dist/internal.es.jsdist/internal.umd.jsdist/shotstack-studio.es.jsdist/shotstack-studio.umd.js

Network endpoints1

unpkg.com/wawoff2@2.0.1/build/decompress_binding.js

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

@shotstack/shotstack-studio@2.23.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code