registry / @vervedoc/core / 3.3.18
@vervedoc/core@3.3.18
VerveDoc Core 核心编辑器库（Canvas 2D 高性能实现）
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package describes and exports a document editor, and its clipboard code handles editor content through explicit copy and paste commands. The inspected excerpts show no wallet-address replacement or unrelated collection behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Clipboard access occurs through editor copy, cut, and paste command handling.
Impact
No cryptocurrency address substitution, credential collection, or unrelated data transfer was identified.
Mechanism
The code transfers editor text and VerveDoc document fragments through the browser clipboard.
AI rationale
The package describes and exports a document editor, and its clipboard code handles editor content through explicit copy and paste commands. The inspected excerpts show no wallet-address replacement or unrelated collection behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports the core editor bundles as the package entrypoints.
- The README describes the package as a Canvas document editing engine.
- Clipboard writes use editor copy content and a VerveDoc-specific document format.
- Clipboard reads occur in the executePaste command path and use the clipboard state guard.
Evidence against
- The static scanner flags clipboard access, but the inspected code does not show cryptocurrency address matching or replacement.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/core.js5.95 MB file, sampled 256 KB
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/core.umd.cjsView file
1(function(){"use strict";try{if(typeof document<"u"){var p=document.createElement("style");p.id="vervedoc-core-style",p.appendChild(document.createTextNode('@font-face{font-family:...
L2: (function(W,me){typeof exports=="object"&&typeof module<"u"?me(exports):typeof define=="function"&&define.amd?define(["exports"],me):(W=typeof globalThis<"u"?globalThis:W||self,me(...
L3: `||J===" ")return v;if(J===""||J==="\uFEFF")continue;const A=jt(y,J,this.opts.defaultFont);v+=this.measure.charWidth(J,A,k,!!y.bold,!!y.italic)}}return v},It=e.resume?qe.findIndex...
...
L426: </div>\r
L427: `;class ha{constructor(){O(this,"root",null);O(this,"translate")}setTranslate(e){this.translate=e}t(e){return de(this.translate,e)}show(e,t,n){this.hide();const i=document.createEl...
L428: @page{margin:0}${r};
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/core.umd.cjsView on unpkg · L1•Trigger-reachable chain: manifest.main -> dist/core.umd.cjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core.umd.cjsView on unpkgdist/core.js
Findings
2 Critical3 Medium7 Low
CriticalClipboard Crypto Hijackdist/core.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/core.umd.cjs
MediumNetwork
MediumOversized Source Filedist/core.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review EvidenceREADME.md
LowAi Review Evidencedist/core.js
LowAi Review Evidencedist/core.js
Affected versions and remediation
This report applies to @vervedoc/core@3.3.18.
See all versions of @vervedoc/core for other recorded verdicts.
- Review the evidence and your use of @vervedoc/core@3.3.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.