Loading npm security reports…
A video editing library for creating and editing videos with Shotstack
At runtime, rendering features can download WebAssembly from two external URLs and execute it. This is a supply-chain risk, but no malicious follow-on behavior was found.
Package source references dynamic code evaluation.
dist/shotstack-studio.umd.jsView on unpkg · L198Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/shotstack-studio.umd.jsView on unpkg · L65Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/shotstack-studio.es.jsView on unpkg · L44562A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/shotstack-studio.es.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/shotstack-studio.es.jsView on unpkgThis report applies to @shotstack/shotstack-studio@2.19.5.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic code evaluation.
dist/shotstack-studio.umd.jsView on unpkg · L198Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/shotstack-studio.umd.jsView on unpkg · L65Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/shotstack-studio.es.jsView on unpkg · L44562A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/shotstack-studio.es.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/shotstack-studio.es.jsView on unpkg