registry / @vervedoc/core / 3.3.17
@vervedoc/core@3.3.17
VerveDoc Core 核心编辑器库（Canvas 2D 高性能实现）
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe reported clipboard behavior matches ordinary editor copy and paste flows triggered by user commands. The package declares no install hook, and the inspected clipboard code shows no wallet-address substitution or unrelated side effect.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes copy, cut, or paste with a keyboard shortcut or editor command.
Impact
No unauthorized clipboard modification or other harmful effect was identified.
Mechanism
The editor writes copied content to the clipboard and reads clipboard content for paste commands.
AI rationale
The reported clipboard behavior matches ordinary editor copy and paste flows triggered by user commands. The package declares no install hook, and the inspected clipboard code shows no wallet-address substitution or unrelated side effect.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports editor bundles and declares only clean, build, and type-check scripts; it has no install lifecycle hook.
- Clipboard shortcuts dispatch copy, cut, and paste commands in response to keyboard events.
- Copy writes editor content to the clipboard; paste reads clipboard content for the editor.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/core.js5.95 MB file, sampled 256 KB
HighEntropyStringsUrlStringswww.w3.org
dist/core.umd.cjs
Source & flagged code
7 flaggeddist/core.umd.cjsView file
1(function(){"use strict";try{if(typeof document<"u"){var p=document.createElement("style");p.id="vervedoc-core-style",p.appendChild(document.createTextNode('@font-face{font-family:...
L2: (function(W,me){typeof exports=="object"&&typeof module<"u"?me(exports):typeof define=="function"&&define.amd?define(["exports"],me):(W=typeof globalThis<"u"?globalThis:W||self,me(...
L3: `||J===" ")return v;if(J===""||J==="\uFEFF")continue;const A=jt(y,J,this.opts.defaultFont);v+=this.measure.charWidth(J,A,k,!!y.bold,!!y.italic)}}return v},It=e.resume?qe.findIndex...
...
L426: </div>\r
L427: `;class ca{constructor(){O(this,"root",null);O(this,"translate")}setTranslate(e){this.translate=e}t(e){return de(this.translate,e)}show(e,t,n){this.hide();const i=document.createEl...
L428: @page{margin:0}${r};
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/core.umd.cjsView on unpkg · L1•Trigger-reachable chain: manifest.main -> dist/core.umd.cjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core.umd.cjsView on unpkgdist/core.js
Findings
2 Critical3 Medium7 Low
CriticalClipboard Crypto Hijackdist/core.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/core.umd.cjs
MediumNetwork
MediumOversized Source Filedist/core.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/core.js
LowAi Review Evidencedist/core.js
LowAi Review Evidencedist/core.js
Affected versions and remediation
This report applies to @vervedoc/core@3.3.17.
See all versions of @vervedoc/core for other recorded verdicts.
- Review the evidence and your use of @vervedoc/core@3.3.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.