registry / @univerjs-pro/collaboration-client / 1.2.0
@univerjs-pro/collaboration-client@1.2.0
Client-side collaboration plugin for Univer Pro.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected source does not establish malicious behavior, but pervasive obfuscation and the unresolved collaboration dependency leave meaningful runtime uncertainty. The encrypted header behavior has a plausible product use, yet its recipient and purpose could not be verified here, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the client and issuing HTTP requests through its configured HTTP service.
Impact
The header may disclose a domain-derived identifier to the configured service, but the inspected source does not establish an unrelated recipient or malicious use.
Mechanism
The client may attach an encrypted value derived from the current domain and time when a global key is available; the code does not identify a fixed recipient in the inspected excerpt.
AI rationale
The inspected source does not establish malicious behavior, but pervasive obfuscation and the unresolved collaboration dependency leave meaningful runtime uncertainty. The encrypted header behavior has a plausible product use, yet its recipient and purpose could not be verified here, so a warning is appropriate.
Evidence
package.jsonlib/es/index.jslib/cjs/index.jslib/locale/pl-PL.js
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The published JavaScript entrypoint is heavily obfuscated, making its runtime behavior harder to verify.
- The client derives an encrypted host and timestamp value from a global key and adds it to HTTP request headers; the recipient depends on the configured HTTP service.
- The manifest declares the collaboration package as a runtime dependency, but its source was unavailable in this inspection.
Evidence against
- The inspected Polish locale file contains translated collaboration messages and exports a locale object; it does not show the reported payload execution behavior.
- The manifest has no install lifecycle hook, and the inspected excerpt shows no fixed network recipient.
Behavioral surface
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
7 flaggedlib/locale/pl-PL.jsView file
1const _0x31a0a0=_0x865b;(function(_0x3d7541,_0x2b8f84){const _0x4e028e=_0x865b,_0x2dfc6c=_0x3d7541();while(!![]){try{const _0x17ba10=parseInt(_0x4e028e(0x1a4))/0x1*(-parseInt(_0x4e...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/locale/pl-PL.jsView on unpkg · L11const _0x31a0a0=_0x865b;(function(_0x3d7541,_0x2b8f84){const _0x4e028e=_0x865b,_0x2dfc6c=_0x3d7541();while(!![]){try{const _0x17ba10=parseInt(_0x4e028e(0x1a4))/0x1*(-parseInt(_0x4e028e(0x1b0))/0x2)+parseInt(_0x4e028e(0x19e))/0x3*(parseInt(_0x4e028e(0x19a))/0x4)+-parseInt(_0x4e028e(0x1af))/0x5*(-parseInt(_0x4e028e(0x1a2))/0x6)+-parseInt(_0x4e028e(0x1a1))/0x7+-parseInt(_0x4e028e(0x19d))/0x8*(parseInt(_0x4e028e(0x1a7))/
Medium
Ai Review Evidence
The published JavaScript entrypoint is heavily obfuscated, making its runtime behavior harder to verify.
lib/locale/pl-PL.jsView on unpkg · L1lib/cjs/index.jsView file
Findings
3 High6 Medium3 Low
HighObfuscated Payload Loaderlib/locale/pl-PL.js
HighCopied Package Dependency Bridgelib/cjs/index.js
HighObfuscated
MediumStructural Risk Force Deep Review
MediumAi Review Evidencelib/locale/pl-PL.js
MediumAi Review Evidencelib/es/index.js
MediumAi Review Evidencelib/es/index.js
MediumSuspicious Dependency Evidencepackage.json
MediumAi Review Evidencelib/cjs/index.js
LowScripts Present
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @univerjs-pro/collaboration-client@1.2.0.
See all versions of @univerjs-pro/collaboration-client for other recorded verdicts.
- Review the evidence and your use of @univerjs-pro/collaboration-client@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.