registry / @vervedoc/core / 3.3.15
@vervedoc/core@3.3.15
VerveDoc Core 核心编辑器库（Canvas 2D 高性能实现）
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package’s entrypoints lead to editor bundles, and the flagged clipboard behavior is ordinary command-driven editing logic. No wallet-address substitution or other attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Clipboard operations run in response to explicit editor copy, cut, or paste commands.
Impact
No cryptocurrency address rewriting, credential collection, or unrelated data transmission was identified.
Mechanism
The editor writes selected text and its own document fragment, or reads clipboard text and pastes it into the document. A guard prevents applying an operation after the editor state changes.
AI rationale
The package’s entrypoints lead to editor bundles, and the flagged clipboard behavior is ordinary command-driven editing logic. No wallet-address substitution or other attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports editor bundles from dist/core.js and dist/core.umd.cjs.
- The declared npm scripts are build, clean, and type checking; there are no install lifecycle scripts.
- Clipboard handling is attached to explicit editor copy and cut commands and writes selected text plus the editor’s own document fragment.
- Paste handling runs for explicit paste commands and reads clipboard text or the editor’s custom document format.
- A guard checks that the editor, document, zone, and selection are still current before applying clipboard actions.
Evidence against
- Searches found no cryptocurrency address patterns or wallet-specific logic in the readable bundle source.
- The clipboard code performs ordinary editor copy, cut, and paste operations; no clipboard replacement or unrelated network transmission was identified.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/core.umd.cjsView file
1(function(){"use strict";try{if(typeof document<"u"){var p=document.createElement("style");p.id="vervedoc-core-style",p.appendChild(document.createTextNode('@font-face{font-family:...
L2: (function(L,pe){typeof exports=="object"&&typeof module<"u"?pe(exports):typeof define=="function"&&define.amd?define(["exports"],pe):(L=typeof globalThis<"u"?globalThis:L||self,pe(...
L3: `||A===" ")return Q;A===""||A==="\uFEFF"||(Q+=this.measure.charWidth(A,Ye,Ze,!!U.bold,!!U.italic))}}return Q};for(let b=0;b<i.length;b++){const v=i[b],Q=et[b];if(Q.type!=="text")c...
...
L371: </div>\r
L372: `;class rr{constructor(){S(this,"root",null);S(this,"translate")}setTranslate(e){this.translate=e}t(e){return re(this.translate,e)}show(e,t,n){this.hide();const i=document.createEl...
L373: @page{margin:0}${i};
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/core.umd.cjsView on unpkg · L1•Trigger-reachable chain: manifest.main -> dist/core.umd.cjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core.umd.cjsView on unpkgdist/core.js
Findings
2 Critical3 Medium7 Low
CriticalClipboard Crypto Hijackdist/core.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/core.umd.cjs
MediumNetwork
MediumOversized Source Filedist/core.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/core.js
LowAi Review Evidencedist/core.js
Affected versions and remediation
This report applies to @vervedoc/core@3.3.15.
See all versions of @vervedoc/core for other recorded verdicts.
- Review the evidence and your use of @vervedoc/core@3.3.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.