registry / @shotstack/shotstack-studio / 2.22.8

@shotstack/shotstack-studio@2.22.8

A video editing library for creating and editing videos with Shotstack

AI Security Review

scanned 10d ago · by lpm-firewall-ai

A browser-side WOFF2 decompression path downloads JavaScript from an external CDN and evaluates it. This creates a remote code-execution supply-chain surface if that response is altered.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading a WOFF2 font that requires the bundled font loader's decompressor.

Impact

Code supplied by the external CDN can execute in the consuming application's browser context. No install-time or AI-agent control-surface attack was confirmed.

Mechanism

The loader fetches decompressor source text and passes it to the Function constructor before using the resulting module.

AI rationale

The package is not proven malicious, but dynamically executing remotely fetched code is a concrete security risk. The agent-integration hints resolve to ordinary animation-plugin code and do not change that finding.

Evidence

dist/internal.es.jsdist/internal.umd.jsdist/shotstack-studio.es.jsdist/shotstack-studio.umd.js

Network endpoints1

unpkg.com/wawoff2@2.0.1/build/decompress_binding.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence with false-positive risk.

@shotstack/shotstack-studio@2.22.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code