registry / @vervedoc/core / 3.3.16
@vervedoc/core@3.3.16
VerveDoc Core 核心编辑器库（Canvas 2D 高性能实现）
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe inspected clipboard code performs ordinary editor copy and paste operations, and the observed network request fetches image content from an image URL. The manifest has no install lifecycle hooks.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Clipboard access is tied to editor copy, cut, and paste commands; image fetching occurs when handling an image URL.
Impact
No malicious impact identified.
Mechanism
The editor copies document text and its own fragment format to the clipboard and fetches image content for download.
AI rationale
The inspected clipboard code performs ordinary editor copy and paste operations, and the observed network request fetches image content from an image URL. The manifest has no install lifecycle hooks.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports editor bundles and declares only clean, build, and type-check scripts; no lifecycle scripts are present.
- Clipboard writes occur in the editor’s copy/cut command path and use the editor’s copied text and document fragment.
- The other observed fetch handles an image URL supplied to the editor and restricts the response to image types.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/core.js5.89 MB file, sampled 256 KB
HighEntropyStringsUrlStringswww.w3.org
Source & flagged code
7 flaggeddist/core.umd.cjsView file
1(function(){"use strict";try{if(typeof document<"u"){var p=document.createElement("style");p.id="vervedoc-core-style",p.appendChild(document.createTextNode('@font-face{font-family:...
L2: (function(m,ge){typeof exports=="object"&&typeof module<"u"?ge(exports):typeof define=="function"&&define.amd?define(["exports"],ge):(m=typeof globalThis<"u"?globalThis:m||self,ge(...
L3: `||x===" ")return U;x===""||x==="\uFEFF"||(U+=this.measure.charWidth(x,ne,z,!!b.bold,!!b.italic))}}return U};for(let W=0;W<qe.length;W++){const{rawRun:y,sourceIndex:U,path:H,hyper...
...
L371: </div>\r
L372: `;class Kr{constructor(){O(this,"root",null);O(this,"translate")}setTranslate(e){this.translate=e}t(e){return Re(this.translate,e)}show(e,t,n){this.hide();const i=document.createEl...
L373: @page{margin:0}${r};
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/core.umd.cjsView on unpkg · L1•Trigger-reachable chain: manifest.main -> dist/core.umd.cjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core.umd.cjsView on unpkg430
Findings
2 Critical3 Medium7 Low
CriticalClipboard Crypto Hijackdist/core.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/core.umd.cjs
MediumNetwork
MediumOversized Source Filedist/core.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/core.umd.cjs
LowAi Review Evidencedist/core.js
Affected versions and remediation
This report applies to @vervedoc/core@3.3.16.
See all versions of @vervedoc/core for other recorded verdicts.
- Review the evidence and your use of @vervedoc/core@3.3.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.