registry / @shotstack/shotstack-studio / 2.16.3

@shotstack/shotstack-studio@2.16.3

A video editing library for creating and editing videos with Shotstack

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed attack surface was identified. The flagged plugin functions support animation rendering, and inspected dynamic loading supports fonts and graphics.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Applications import the library and invoke media or font rendering; no automatic registry-install attack was identified.

Impact

The inspected behavior enables video editing and font rendering; no credential theft, agent control mutation, or destructive behavior was established.

Mechanism

Animation plugins update in-memory rendering state, while font loaders retrieve rendering assets and a pinned decompressor.

AI rationale

Inspected source supports ordinary video editing and rendering behavior, including the four flagged plugin locations. No concrete malicious installation, credential harvesting, exfiltration, or AI-agent configuration behavior was found.

Network endpoints1

unpkg.com/wawoff2@2.0.1/build/decompress_binding.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

@shotstack/shotstack-studio@2.16.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code