registry / @wix/editor-react-components / 1.2302.0

@wix/editor-react-components@1.2302.0

React components for the Wix Editor

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Browser requests support rendered media, icons, SVGs, and Vimeo embeds; the Lottie expression evaluator is bundled rendering-library behavior activated by supplied animation data.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports a component and renders media, SVG, Vimeo, or Lottie content.

Impact

No install-time execution, local credential access, persistence, or exfiltration chain was found.

Mechanism

User-invoked browser component rendering and media retrieval.

Rationale

The scanner's Unicode and eval findings are attributable to date-formatting bidi isolation and bundled Lottie animation support. Source inspection found no concrete malicious behavior or package-install attack chain.

Evidence

package.jsondist/site/components/Lottie/component.jsdist/site/components/chunks/DateField.jsdist/site/components/chunks/svg.jsdist/site/components/SocialPlayerVimeo/component.jsREADME.mddist/site/components/TextInput/component.js

Network endpoints2

vimeo.com/api/oembed.jsonstatic.parastorage.com/services/wix-ui-icons-common/dist/icons/

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/site/components/Lottie/component.js` bundles an `eval` path for Lottie animation expressions when rendering supplied animation data.

Evidence against

`package.json` exports only `dist/site` modules and defines no preinstall/install/postinstall/prepare hook.
`dist/site/components/chunks/DateField.js` bidi controls are explicit LRI/PDI date-time display literals, not hidden executable syntax.
`dist/site/components/chunks/svg.js` fetches caller-provided SVG media and sanitizes non-Wix SVG content.
`dist/site/components/SocialPlayerVimeo/component.js` uses Vimeo's oEmbed endpoint for the Vimeo player.
No executable files, shebangs, child-process calls, credential harvesting, or agent-control-surface writes were found.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 312 file(s), 6.07 MB of source, external domains: aomedia.org, api.whatsapp.com, base-ui.com, editor.wix.com, facebook.com, fb.me, files.wix.com, github.com, maps.googleapis.com, pinterest.com, static.filesuser.com, static.parastorage.com, static.wixstatic.com, twitter.com, video.wixstatic.com, vimeo.com, visgl.github.io, www.facebook.com, www.google.com, www.instagram.com, www.linkedin.com, www.snapchat.com, www.tiktok.com, www.w3.org, www.wix.com, www.youtube.com

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

Lines 6403-6443javascript

6403 else segment.value = numberFormatter.format(value);

6404 }

6405 let processedSegments = [];

6406 for (let segment of segments) {

6407 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

6408 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

6409 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

6410 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

6411 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

6412 let dateSegment = {

6413 type,

6414 text: isPlaceholder ? placeholder : segment.value,

6415 ...displayValue.getSegmentLimits(type),

6416 isPlaceholder,

6417 placeholder,

6418 isEditable

6419 };

6420 if (type === "hour") {

6421 processedSegments.push({

6422 type: "literal",

6423 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

6424 isPlaceholder: false,

6425 placeholder: "",

6426 isEditable: false

6427 });

6428 processedSegments.push(dateSegment);

6429 if (type === granularity) processedSegments.push({

6430 type: "literal",

6431 text: "⁩",

6432 isPlaceholder: false,

6433 placeholder: "",

6434 isEditable: false

6435 });

6436 } else if (timeValue.includes(type) && type === granularity) {

6437 processedSegments.push(dateSegment);

6438 processedSegments.push({

6439 type: "literal",

6440 text: "⁩",

6441 isPlaceholder: false,

6442 placeholder: "",

6443 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder:

Source & flagged code

3 flagged · loading source

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

6423contains invisible/control Unicode U+2066 (left-to-right isolate) text: "<U+2066>",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

dist/site/components/chunks/constants3.jsView file

61patternName = generic_password severity = medium line = 61 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/site/components/chunks/constants3.js

dist/site/components/chunks/constants3.jsView on unpkg · L61

Findings

1 Critical4 Medium4 Low

CriticalTrojan Source Unicodedist/site/components/chunks/DateField.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/site/components/chunks/constants3.js

LowScripts Present

LowEvaldist/site/components/Lottie/component.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

Lines 6403-6443javascript

6403 else segment.value = numberFormatter.format(value);

6404 }

6405 let processedSegments = [];

6406 for (let segment of segments) {

6407 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

6408 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

6409 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

6410 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

6411 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

6412 let dateSegment = {

6413 type,

6414 text: isPlaceholder ? placeholder : segment.value,

6415 ...displayValue.getSegmentLimits(type),

6416 isPlaceholder,

6417 placeholder,

6418 isEditable

6419 };

6420 if (type === "hour") {

6421 processedSegments.push({

6422 type: "literal",

6423 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

6424 isPlaceholder: false,

6425 placeholder: "",

6426 isEditable: false

6427 });

6428 processedSegments.push(dateSegment);

6429 if (type === granularity) processedSegments.push({

6430 type: "literal",

6431 text: "⁩",

6432 isPlaceholder: false,

6433 placeholder: "",

6434 isEditable: false

6435 });

6436 } else if (timeValue.includes(type) && type === granularity) {

6437 processedSegments.push(dateSegment);

6438 processedSegments.push({

6439 type: "literal",

6440 text: "⁩",

6441 isPlaceholder: false,

6442 placeholder: "",

6443 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder: