registry / @wix/editor-react-components / 1.2306.0

@wix/editor-react-components@1.2306.0

React components for the Wix Editor

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package exports browser-facing React components and has no install-time hook.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports and renders a component; Lottie expressions additionally require enabled expression rendering.

Impact

No package-side credential theft, persistence, destructive action, or install-time mutation found.

Mechanism

UI rendering, media loading, and optional Lottie expression evaluation.

Rationale

The scanner findings resolve to normal bundled UI functionality: Lottie's guarded expression evaluator and intentional bidi formatting controls. Direct inspection found no lifecycle execution or concrete malicious behavior.

Evidence

package.jsondist/site/components/Lottie/component.jsdist/site/components/chunks/DateField.jsdist/site/components/chunks/svg.jsdist/site/components/GoogleMap/component.jsdist/site/components/VideoUpload/sdk.jsdist/site/components/chunks/Video.js

Network endpoints4

maps.googleapis.com/maps/api/jsfiles.wix.com/site/media/files/${videoId}/infostatic.wixstatic.com/media/video.wixstatic.com/

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/site/components/Lottie/component.js contains eval for Lottie expression rendering when runExpressions is enabled.

Evidence against

package.json has no preinstall, install, postinstall, prepare, or bin entry.
Published payload is limited to dist/site via package.json files and exports.
No child_process, Node filesystem, credential harvesting, or persistence APIs found in inspected package files.
DateField bidi characters are explicit LRI/PDI literals used while constructing hour segments.
Network calls are component/runtime media, map, SVG, and video functionality; no exfiltration path was identified.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 312 file(s), 6.07 MB of source, external domains: aomedia.org, api.whatsapp.com, base-ui.com, editor.wix.com, facebook.com, fb.me, files.wix.com, github.com, maps.googleapis.com, pinterest.com, static.filesuser.com, static.parastorage.com, static.wixstatic.com, twitter.com, video.wixstatic.com, vimeo.com, visgl.github.io, www.facebook.com, www.google.com, www.instagram.com, www.linkedin.com, www.snapchat.com, www.tiktok.com, www.w3.org, www.wix.com, www.youtube.com

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

Lines 6403-6443javascript

6403 else segment.value = numberFormatter.format(value);

6404 }

6405 let processedSegments = [];

6406 for (let segment of segments) {

6407 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

6408 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

6409 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

6410 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

6411 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

6412 let dateSegment = {

6413 type,

6414 text: isPlaceholder ? placeholder : segment.value,

6415 ...displayValue.getSegmentLimits(type),

6416 isPlaceholder,

6417 placeholder,

6418 isEditable

6419 };

6420 if (type === "hour") {

6421 processedSegments.push({

6422 type: "literal",

6423 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

6424 isPlaceholder: false,

6425 placeholder: "",

6426 isEditable: false

6427 });

6428 processedSegments.push(dateSegment);

6429 if (type === granularity) processedSegments.push({

6430 type: "literal",

6431 text: "⁩",

6432 isPlaceholder: false,

6433 placeholder: "",

6434 isEditable: false

6435 });

6436 } else if (timeValue.includes(type) && type === granularity) {

6437 processedSegments.push(dateSegment);

6438 processedSegments.push({

6439 type: "literal",

6440 text: "⁩",

6441 isPlaceholder: false,

6442 placeholder: "",

6443 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder:

Source & flagged code

3 flagged · loading source

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

6423contains invisible/control Unicode U+2066 (left-to-right isolate) text: "<U+2066>",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

dist/site/components/chunks/constants3.jsView file

61patternName = generic_password severity = medium line = 61 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/site/components/chunks/constants3.js

dist/site/components/chunks/constants3.jsView on unpkg · L61

Findings

1 Critical4 Medium4 Low

CriticalTrojan Source Unicodedist/site/components/chunks/DateField.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/site/components/chunks/constants3.js

LowScripts Present

LowEvaldist/site/components/Lottie/component.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

Lines 6403-6443javascript

6403 else segment.value = numberFormatter.format(value);

6404 }

6405 let processedSegments = [];

6406 for (let segment of segments) {

6407 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

6408 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

6409 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

6410 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

6411 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

6412 let dateSegment = {

6413 type,

6414 text: isPlaceholder ? placeholder : segment.value,

6415 ...displayValue.getSegmentLimits(type),

6416 isPlaceholder,

6417 placeholder,

6418 isEditable

6419 };

6420 if (type === "hour") {

6421 processedSegments.push({

6422 type: "literal",

6423 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

6424 isPlaceholder: false,

6425 placeholder: "",

6426 isEditable: false

6427 });

6428 processedSegments.push(dateSegment);

6429 if (type === granularity) processedSegments.push({

6430 type: "literal",

6431 text: "⁩",

6432 isPlaceholder: false,

6433 placeholder: "",

6434 isEditable: false

6435 });

6436 } else if (timeValue.includes(type) && type === granularity) {

6437 processedSegments.push(dateSegment);

6438 processedSegments.push({

6439 type: "literal",

6440 text: "⁩",

6441 isPlaceholder: false,

6442 placeholder: "",

6443 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder: