registry / @wix/editor-react-components / 1.2329.0

@wix/editor-react-components@1.2329.0

React components for the Wix Editor

AI Security Review

scanned 19h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network use is limited to user-invoked editor/media/map component functionality.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Rendering or using Lottie, VideoUpload, or GoogleMap components.

Impact

No package-install mutation, persistence, exfiltration chain, or remote payload execution was established.

Mechanism

Browser-side component rendering, media metadata retrieval, and Maps API loading.

Rationale

Direct inspection finds a bundled Wix editor component package without install-time execution or a concrete malicious chain. Scanner findings map to expected Lottie expression support, Unicode-aware formatting, and component-aligned browser networking.

Evidence

package.jsondist/site/components/Lottie/component.jsdist/site/components/VideoUpload/sdk.jsdist/site/components/GoogleMap/component.jsdist/site/components/chunks/Tooltip.jsdist/site/components/extensions.js

Network endpoints2

files.wix.com/site/media/files/${videoId}/infomaps.googleapis.com/maps/api/js

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/site/components/Lottie/component.js` evaluates Lottie expression text when `runExpressions` is enabled.
`dist/site/components/VideoUpload/sdk.js` requests Wix video metadata through the Wix SDK auth wrapper.
`dist/site/components/GoogleMap/component.js` injects the Google Maps API script on component use.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
Exports are browser/editor React component modules under `dist/site/components`; no bin or native artifact was found.
The Lottie `eval` is in the animation-expression engine, gated by render configuration, not install/import execution.
Tooltip bidi controls are explicit LRI/PDI literal segments for localized date formatting in `dist/site/components/chunks/Tooltip.js`.
Network targets are feature-aligned Wix media and Google Maps endpoints; no credential harvesting, shell execution, filesystem mutation, or agent-control writes found.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 320 file(s), 6.13 MB of source, external domains: aomedia.org, api.whatsapp.com, base-ui.com, editor.wix.com, facebook.com, fb.me, files.wix.com, github.com, maps.googleapis.com, pinterest.com, static.filesuser.com, static.parastorage.com, static.wixstatic.com, twitter.com, video.wixstatic.com, vimeo.com, visgl.github.io, www.facebook.com, www.google.com, www.instagram.com, www.linkedin.com, www.snapchat.com, www.tiktok.com, www.w3.org, www.wix.com, www.youtube.com

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/Tooltip.jsView file

Lines 7171-7211javascript

7171 else segment.value = numberFormatter.format(value);

7172 }

7173 let processedSegments = [];

7174 for (let segment of segments) {

7175 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

7176 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

7177 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

7178 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

7179 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

7180 let dateSegment = {

7181 type,

7182 text: isPlaceholder ? placeholder : segment.value,

7183 ...displayValue.getSegmentLimits(type),

7184 isPlaceholder,

7185 placeholder,

7186 isEditable

7187 };

7188 if (type === "hour") {

7189 processedSegments.push({

7190 type: "literal",

7191 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/Tooltip.jsView on unpkg · L7191

7192 isPlaceholder: false,

7193 placeholder: "",

7194 isEditable: false

7195 });

7196 processedSegments.push(dateSegment);

7197 if (type === granularity) processedSegments.push({

7198 type: "literal",

7199 text: "⁩",

7200 isPlaceholder: false,

7201 placeholder: "",

7202 isEditable: false

7203 });

7204 } else if (timeValue.includes(type) && type === granularity) {

7205 processedSegments.push(dateSegment);

7206 processedSegments.push({

7207 type: "literal",

7208 text: "⁩",

7209 isPlaceholder: false,

7210 placeholder: "",

7211 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder:

Source & flagged code

3 flagged · loading source

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/Tooltip.jsView file

7191contains invisible/control Unicode U+2066 (left-to-right isolate) text: "<U+2066>",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/Tooltip.jsView on unpkg · L7191

dist/site/components/chunks/constants3.jsView file

61patternName = generic_password severity = medium line = 61 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/site/components/chunks/constants3.js

dist/site/components/chunks/constants3.jsView on unpkg · L61

Findings

1 Critical4 Medium4 Low

CriticalTrojan Source Unicodedist/site/components/chunks/Tooltip.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/site/components/chunks/constants3.js

LowScripts Present

LowEvaldist/site/components/Lottie/component.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/Tooltip.jsView file

Lines 7171-7211javascript

7171 else segment.value = numberFormatter.format(value);

7172 }

7173 let processedSegments = [];

7174 for (let segment of segments) {

7175 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

7176 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

7177 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

7178 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

7179 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

7180 let dateSegment = {

7181 type,

7182 text: isPlaceholder ? placeholder : segment.value,

7183 ...displayValue.getSegmentLimits(type),

7184 isPlaceholder,

7185 placeholder,

7186 isEditable

7187 };

7188 if (type === "hour") {

7189 processedSegments.push({

7190 type: "literal",

7191 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/Tooltip.jsView on unpkg · L7191

7192 isPlaceholder: false,

7193 placeholder: "",

7194 isEditable: false

7195 });

7196 processedSegments.push(dateSegment);

7197 if (type === granularity) processedSegments.push({

7198 type: "literal",

7199 text: "⁩",

7200 isPlaceholder: false,

7201 placeholder: "",

7202 isEditable: false

7203 });

7204 } else if (timeValue.includes(type) && type === granularity) {

7205 processedSegments.push(dateSegment);

7206 processedSegments.push({

7207 type: "literal",

7208 text: "⁩",

7209 isPlaceholder: false,

7210 placeholder: "",

7211 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder: