Loading npm security reports…
A video editing library for creating and editing videos with Shotstack
A WOFF2 font load fetches an external JavaScript decompressor and evaluates its response. No confirmed attack against package consumers was identified, but the network response has code-execution authority in the browser.
Package source references dynamic code evaluation.
dist/shotstack-studio.umd.jsView on unpkg · L198Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/shotstack-studio.umd.jsView on unpkg · L65Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/shotstack-studio.es.jsView on unpkg · L44680A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/shotstack-studio.es.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/shotstack-studio.es.jsView on unpkgThis report applies to @shotstack/shotstack-studio@2.23.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic code evaluation.
dist/shotstack-studio.umd.jsView on unpkg · L198Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/shotstack-studio.umd.jsView on unpkg · L65Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/shotstack-studio.es.jsView on unpkg · L44680A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/shotstack-studio.es.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/shotstack-studio.es.jsView on unpkg