registry / @wix/editor-react-components / 1.2338.0

@wix/editor-react-components@1.2338.0

React components for the Wix Editor

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network and expression behavior belongs to rendered Wix media components and is not install-time.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer renders configured Lottie, icon, or social-media components.

Impact

No package-originated persistence, secret access, or unconsented code execution was established.

Mechanism

Browser-side component asset and media loading.

Rationale

Source inspection contradicts the scanner’s malicious label: there are no lifecycle hooks or Node-side attack primitives. The flagged eval and bidi controls have package-aligned Lottie and locale-rendering contexts, with no concrete malicious chain.

Evidence

package.jsondist/site/components/Lottie/component.jsdist/site/components/TextInput/component.jsdist/site/components/SocialPlayerVimeo/component.jsdist/site/components/chunks/Tooltip.jsdist/site/components/chunks/isObjectLike.js

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/site/components/Lottie/component.js` evaluates Lottie expression strings at runtime.
Lottie animation data may be fetched from the component-provided `animationUrl`.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, `prepare`, or `bin` entrypoint.
Published files are limited to browser-oriented `dist/site` components.
No Node filesystem, child-process, credential-harvesting, or agent-control writes were found.
`Tooltip.js` bidi characters are explicit Unicode isolation literals for time-segment rendering.
Network calls load configured media, icons, or embeds; no exfiltration path was identified.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 320 file(s), 6.14 MB of source, external domains: aomedia.org, api.whatsapp.com, base-ui.com, editor.wix.com, facebook.com, fb.me, files.wix.com, github.com, maps.googleapis.com, pinterest.com, static.filesuser.com, static.parastorage.com, static.wixstatic.com, twitter.com, video.wixstatic.com, vimeo.com, visgl.github.io, www.facebook.com, www.google.com, www.instagram.com, www.linkedin.com, www.snapchat.com, www.tiktok.com, www.w3.org, www.wix.com, www.youtube.com

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/Tooltip.jsView file

Lines 7171-7211javascript

7171 else segment.value = numberFormatter.format(value);

7172 }

7173 let processedSegments = [];

7174 for (let segment of segments) {

7175 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

7176 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

7177 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

7178 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

7179 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

7180 let dateSegment = {

7181 type,

7182 text: isPlaceholder ? placeholder : segment.value,

7183 ...displayValue.getSegmentLimits(type),

7184 isPlaceholder,

7185 placeholder,

7186 isEditable

7187 };

7188 if (type === "hour") {

7189 processedSegments.push({

7190 type: "literal",

7191 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/Tooltip.jsView on unpkg · L7191

7192 isPlaceholder: false,

7193 placeholder: "",

7194 isEditable: false

7195 });

7196 processedSegments.push(dateSegment);

7197 if (type === granularity) processedSegments.push({

7198 type: "literal",

7199 text: "⁩",

7200 isPlaceholder: false,

7201 placeholder: "",

7202 isEditable: false

7203 });

7204 } else if (timeValue.includes(type) && type === granularity) {

7205 processedSegments.push(dateSegment);

7206 processedSegments.push({

7207 type: "literal",

7208 text: "⁩",

7209 isPlaceholder: false,

7210 placeholder: "",

7211 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder: "Placeholder text",

47 tooltip: "Tooltip",

48 autoComplete: "Autocomplete",

49 readOnly: "Read only",

50 required: "Required",

51 errorMessageType: "Error message format",

52 prefix: "Prefix",

53 step: "Step"

54 },

55 options: {

56 text: "Text",

57 number: "Number",

58 email: "Email",

59 url: "URL",

60 tel: "Phone number",

61 password: "Password",

Medium

Secret Pattern

Hardcoded password in dist/site/components/chunks/constants3.js

dist/site/components/chunks/constants3.jsView on unpkg · L61

62 center: "Center",

63 start: "Left",

64 end: "Right",

65 inline: "Inline",

66 tooltip: "Tooltip"

67 }

68};

69export {

70 DesignStates as D,

71 DisplayNames as a,

72 selectors as s

73};

Source & flagged code

3 flagged · loading source

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/Tooltip.jsView file

7191contains invisible/control Unicode U+2066 (left-to-right isolate) text: "<U+2066>",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/Tooltip.jsView on unpkg · L7191

dist/site/components/chunks/constants3.jsView file

61patternName = generic_password severity = medium line = 61 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/site/components/chunks/constants3.js

dist/site/components/chunks/constants3.jsView on unpkg · L61

Findings

1 Critical4 Medium4 Low

CriticalTrojan Source Unicodedist/site/components/chunks/Tooltip.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/site/components/chunks/constants3.js

LowScripts Present

LowEvaldist/site/components/Lottie/component.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/site/components/Lottie/component.jsView file

13712var scoped_bm_rt; L13713: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0]; L13714: var numKeys = property.kf ? data.k.length : 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/site/components/Lottie/component.jsView on unpkg · L13712

dist/site/components/chunks/Tooltip.jsView file

Lines 7171-7211javascript

7171 else segment.value = numberFormatter.format(value);

7172 }

7173 let processedSegments = [];

7174 for (let segment of segments) {

7175 let type = $8e7461aabf74661f$var$TYPE_MAPPING[segment.type] || segment.type;

7176 let isEditable = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type];

7177 if (type === "era" && calendar.getEras().length === 1) isEditable = false;

7178 let isPlaceholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] && displayValue[segment.type] == null;

7179 let placeholder = $8e7461aabf74661f$var$EDITABLE_SEGMENTS[type] ? $8e5fbb9a25791ca0$export$d3f5c5e0a5023fa0(type, segment.value, locale) : null;

7180 let dateSegment = {

7181 type,

7182 text: isPlaceholder ? placeholder : segment.value,

7183 ...displayValue.getSegmentLimits(type),

7184 isPlaceholder,

7185 placeholder,

7186 isEditable

7187 };

7188 if (type === "hour") {

7189 processedSegments.push({

7190 type: "literal",

7191 text: "⁦",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/site/components/chunks/Tooltip.jsView on unpkg · L7191

7192 isPlaceholder: false,

7193 placeholder: "",

7194 isEditable: false

7195 });

7196 processedSegments.push(dateSegment);

7197 if (type === granularity) processedSegments.push({

7198 type: "literal",

7199 text: "⁩",

7200 isPlaceholder: false,

7201 placeholder: "",

7202 isEditable: false

7203 });

7204 } else if (timeValue.includes(type) && type === granularity) {

7205 processedSegments.push(dateSegment);

7206 processedSegments.push({

7207 type: "literal",

7208 text: "⁩",

7209 isPlaceholder: false,

7210 placeholder: "",

7211 isEditable: false

dist/site/components/chunks/constants3.jsView file

Lines 41-74javascript

41 min: "Minimum value",

42 max: "Maximum value",

43 pattern: "Pattern validation",

44 phoneFormat: "Phone format",

45 label: "Label text",

46 placeholder: "Placeholder text",

47 tooltip: "Tooltip",

48 autoComplete: "Autocomplete",

49 readOnly: "Read only",

50 required: "Required",

51 errorMessageType: "Error message format",

52 prefix: "Prefix",

53 step: "Step"

54 },

55 options: {

56 text: "Text",

57 number: "Number",

58 email: "Email",

59 url: "URL",

60 tel: "Phone number",

61 password: "Password",

Medium

Secret Pattern

Hardcoded password in dist/site/components/chunks/constants3.js

dist/site/components/chunks/constants3.jsView on unpkg · L61

62 center: "Center",

63 start: "Left",

64 end: "Right",

65 inline: "Inline",

66 tooltip: "Tooltip"

67 }

68};

69export {

70 DesignStates as D,

71 DisplayNames as a,

72 selectors as s

73};