@univerjs-pro/collaboration-client@0.25.2
⚠ Under reviewClient-side collaboration plugin for Univer Pro.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install-time hook and the locale finding is a false-positive-style string table, but the active bundles are fully obfuscated. Required clean citation coverage cannot be produced because each relevant bundle is a single line exceeding the citation limit.
Decision evidence
public snapshot- The active ES and CJS bundles are heavily string-obfuscated, preventing a reliable source-level determination of all runtime behavior.
- The flagged Polish locale uses the same decoder pattern to assemble translation strings; inspection found no direct executable payload call there.
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- Direct inspection found no literal eval, Function constructor, child_process, process access, fetch, or dynamic import in lib JavaScript files.
- The manifest identifies the package as a client-side collaboration plugin and declares normal Univer and cipher dependencies.
Source & flagged code
2 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/locale/pl-PL.jsView on unpkg · L1Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/cjs/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @univerjs-pro/collaboration-client@0.25.2.
See all versions of @univerjs-pro/collaboration-client for other recorded verdicts.
- Review the evidence and your use of @univerjs-pro/collaboration-client@0.25.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.