registry / @shotstack/shotstack-studio / 2.19.2

@shotstack/shotstack-studio@2.19.2

A video editing library for creating and editing videos with Shotstack

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Loading a WOFF2 font fetches executable JavaScript from a third-party CDN and evaluates it. This is a real remote-code-execution supply-chain risk, but it is not automatically triggered at npm install.

Static reason

The scanner resource watchdog stopped analysis before complete coverage. This unresolved result requires AI review and must not be published as clean, warn, or block.

Trigger

The application loads a WOFF2 font through the package's font loader.

Impact

A compromised CDN response could run arbitrary JavaScript in the host application context.

Mechanism

Remote JavaScript download followed by Function evaluation.

AI rationale

The package contains a concrete remote-code-execution primitive in a user-invoked font-loading feature, but no evidence shows malicious install-time behavior or intentional theft. It should be warned rather than blocked as malware.

Evidence

dist/shotstack-studio.es.js

Network endpoints1

unpkg.com/wawoff2@2.0.1/build/decompress_binding.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The runtime downloads JavaScript from unpkg and executes it with the Function constructor when it handles a WOFF2 font.

@shotstack/shotstack-studio@2.19.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code