@univerjs-pro/collaboration-client
Client-side collaboration plugin for Univer Pro.
This report shows the evidence for @univerjs-pro/collaboration-client@1.3.1. 0 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s obfuscated runtime bundle automatically sends document identifiers and collaboration usage metadata to an injected telemetry service when changesets are sent. This is undisclosed runtime telemetry, so the package should receive a warning rather than a publish block.
Decision evidence
public snapshot- The collaboration session enables telemetry whenever an ITelemetryService instance is present.
- For outgoing changesets, the package collects the document unit ID, changeset type, mutation size, and timing.
- It reports that metadata as a collaboration_new_changeset telemetry event.
- The main entry point is the collaboration client bundle, so this runtime behavior is available on import.
- The manifest describes a client-side collaboration plugin and declares no install or lifecycle scripts.
- The flagged Polish locale excerpt contains collaboration UI messages, consistent with the package purpose.
Source & flagged code
6 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/locale/pl-PL.jsView on unpkg · L1Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/cjs/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @univerjs-pro/collaboration-client@1.3.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @univerjs-pro/collaboration-client@1.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.