registry / @wix/editor-react-components / 1.2309.0

@wix/editor-react-components@1.2309.0

React components for the Wix Editor

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The Lottie component has a package-aligned animation-expression renderer and caller-directed asset loading, but no install-time execution or data exfiltration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer renders the Lottie component with animation data or asset paths.

Impact

Untrusted animation data could invoke the renderer's expression capability; no package-directed compromise behavior was found.

Mechanism

Runtime Lottie expression evaluation and asset loading.

Rationale

The scanner findings map to a standard bundled Lottie renderer and intentional bidirectional text isolates in date formatting. The package contains no lifecycle execution, credential/file collection, persistence, or package-controlled exfiltration chain, so it is not malicious by static source inspection.

Evidence

package.jsondist/site/components/Lottie/component.jsdist/site/components/chunks/DateField.js

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/site/components/Lottie/component.js` evaluates embedded Lottie expression text with `eval` during animation rendering.
The Lottie renderer can request animation/assets through `XMLHttpRequest` using caller-provided paths.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
`package.json` exports browser component modules only from `dist/site`.
No `child_process`, Node filesystem, credential harvesting, or outbound-exfiltration code was found in published JavaScript.
`DateField.js` bidi characters are explicit U+2066/U+2069 literals used as date-segment isolation markers, not hidden source control flow.
The evaluated expression and asset URLs are renderer inputs; no package-controlled payload, endpoint, persistence, or destructive action was identified.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 312 file(s), 6.07 MB of source, external domains: aomedia.org, api.whatsapp.com, base-ui.com, editor.wix.com, facebook.com, fb.me, files.wix.com, github.com, maps.googleapis.com, pinterest.com, static.filesuser.com, static.parastorage.com, static.wixstatic.com, twitter.com, video.wixstatic.com, vimeo.com, visgl.github.io, www.facebook.com, www.google.com, www.instagram.com, www.linkedin.com, www.snapchat.com, www.tiktok.com, www.w3.org, www.wix.com, www.youtube.com

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

Lines 6403-6443javascript

6403 else segment.value = numberFormatter.format(value);

6404 }

6405 let processedSegments = [];

6406 for (let segment of segments) {

6407 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

6408 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

6409 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

6410 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

6411 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

6412 let dateSegment = {

6413 type,

6414 text: isPlaceholder ? placeholder : segment.value,

6415 ...displayValue.getSegmentLimits(type),

6416 isPlaceholder,

6417 placeholder,

6418 isEditable

6419 };

6420 if (type === "hour") {

6421 processedSegments.push({

6422 type: "literal",

6423 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

6424 isPlaceholder: false,

6425 placeholder: "",

6426 isEditable: false

6427 });

6428 processedSegments.push(dateSegment);

6429 if (type === granularity) processedSegments.push({

6430 type: "literal",

6431 text: "⁩",

6432 isPlaceholder: false,

6433 placeholder: "",

6434 isEditable: false

6435 });

6436 } else if (timeValue.includes(type) && type === granularity) {

6437 processedSegments.push(dateSegment);

6438 processedSegments.push({

6439 type: "literal",

6440 text: "⁩",

6441 isPlaceholder: false,

6442 placeholder: "",

6443 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder:

Source & flagged code

3 flagged · loading source

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

6423contains invisible/control Unicode U+2066 (left-to-right isolate) text: "<U+2066>",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

dist/site/components/chunks/constants3.jsView file

61patternName = generic_password severity = medium line = 61 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/site/components/chunks/constants3.js

dist/site/components/chunks/constants3.jsView on unpkg · L61

Findings

1 Critical4 Medium4 Low

CriticalTrojan Source Unicodedist/site/components/chunks/DateField.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/site/components/chunks/constants3.js

LowScripts Present

LowEvaldist/site/components/Lottie/component.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/DateField.jsView file

Lines 6403-6443javascript

6403 else segment.value = numberFormatter.format(value);

6404 }

6405 let processedSegments = [];

6406 for (let segment of segments) {

6407 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

6408 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

6409 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

6410 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

6411 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

6412 let dateSegment = {

6413 type,

6414 text: isPlaceholder ? placeholder : segment.value,

6415 ...displayValue.getSegmentLimits(type),

6416 isPlaceholder,

6417 placeholder,

6418 isEditable

6419 };

6420 if (type === "hour") {

6421 processedSegments.push({

6422 type: "literal",

6423 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/DateField.jsView on unpkg · L6423

6424 isPlaceholder: false,

6425 placeholder: "",

6426 isEditable: false

6427 });

6428 processedSegments.push(dateSegment);

6429 if (type === granularity) processedSegments.push({

6430 type: "literal",

6431 text: "⁩",

6432 isPlaceholder: false,

6433 placeholder: "",

6434 isEditable: false

6435 });

6436 } else if (timeValue.includes(type) && type === granularity) {

6437 processedSegments.push(dateSegment);

6438 processedSegments.push({

6439 type: "literal",

6440 text: "⁩",

6441 isPlaceholder: false,

6442 placeholder: "",

6443 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder: