@zoryn/component@1.1.16
Vue 3 + TypeScript 企业级组件库（pnpm monorepo）。对外主包 `@zoryn/component`，组件 `Z` 前缀，支持完整导入与按需导入。
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe loopback endpoint and debug labels suggest accidentally shipped instrumentation rather than a clear theft operation. Still, the preview sends spreadsheet content automatically without disclosure, so this merits a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Automatic when the spreadsheet preview initializes or rewrites its data.
Impact
A local service listening on the endpoint can receive spreadsheet content and diagnostic details; no credential theft or external transmission was identified.
Mechanism
The preview posts JSON containing a cell sample and formatting diagnostics to a localhost ingest URL.
AI rationale
The loopback endpoint and debug labels suggest accidentally shipped instrumentation rather than a clear theft operation. Still, the preview sends spreadsheet content automatically without disclosure, so this merits a warning.
Evidence
lib/packages/components/grid-import/src/spreadsheet/import-univer-preview.vue_vue_type_script_setup_true_lang.js
Network endpoints1
127.0.0.1:7826/ingest/c4c6e4fe-09d8-4594-a5a0-28b897d88389
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The spreadsheet preview posts to a hard-coded localhost debug-ingest URL.
- The posted diagnostics include a spreadsheet cell sample and style data.
- The send runs when the workbook is initialized and data is written, without a separate user action.
Evidence against
- The manifest has no lifecycle scripts.
- The collector is on 127.0.0.1, with no external host identified in this flow.
- The inspected requests show spreadsheet samples and formatting diagnostics, not credentials or unrelated files.
- The dynamic function generation is in the form designer’s save handler for edited code.
- The zero-width characters found in the minified bundle occur in CodeMirror code; no bidi override characters were found.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
5 flaggedlib/packages/components/form-designer/src/designer/components/FnEditor.jsView file
85try {
L86: fn = new Function("return function (" + this.argStr + "){\n" + str + "\n}")();
L87: } catch (e) {
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/packages/components/form-designer/src/designer/components/FnEditor.jsView on unpkg · L85dist/index.full.min.jsView file
183contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=ct(i,t),o=a.text.length,d,f;function p(n,r){return Or(e,gt(t,n),`div`,a,r)}function m(t,n,r){var i=Pr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.full.min.jsView on unpkg · L183Findings
1 Critical1 High6 Medium4 Low
CriticalTrojan Source Unicodedist/index.full.min.js
HighSemantic Analysis Limiteddist/index.css
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.full.mjs
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
MediumAi Review Evidencelib/packages/components/grid-import/src/spreadsheet/import-univer-preview.vue_vue_type_script_setup_true_lang.js
LowEvallib/packages/components/form-designer/src/designer/components/FnEditor.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zoryn/component@1.1.16.
See all versions of @zoryn/component for other recorded verdicts.
- Review the evidence and your use of @zoryn/component@1.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.