registry / @zuplo/editor
@zuplo/editor
Local development editor for the Zuplo CLI
This report shows the evidence for @zuplo/editor@1.0.41659843214. 0 of 222 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package exports a local editor whose server accesses and watches the explicitly supplied project directory, and startup is an explicit method call. The scanner’s Unicode flag corresponds to CodeMirror detection of special characters; the inspected source did not show malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Consumers import the package and explicitly start its local editor server; the browser client runs when opened.
Impact
No malicious behavior was found in the inspected entry points or flagged source locations.
Mechanism
The server serves editor assets and uses a supplied project directory for file access and watching. The Unicode control-character pattern is part of editor display support.
AI rationale
The package exports a local editor whose server accesses and watches the explicitly supplied project directory, and startup is an explicit method call. The scanner’s Unicode flag corresponds to CodeMirror detection of special characters; the inspected source did not show malicious behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a local development editor and exposes its editor modules through import exports; package.json has no lifecycle scripts.
- The server constructor is supplied a source directory and port, creates a file watcher for configured project folders, and builds the editor filesystem adapter around that directory.
- The server starts only through its explicit start() method and logs that it is starting a local editor server.
- The CodeMirror bundle contains a regular expression to detect and display Unicode control characters, including bidi controls.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/html.worker-D9ugpX4y.jsView file
24`).length>=15&&Ba(n,e=>e.length>=2)>=2}),o=Ga(e,o),o}function Ba(e,t){let n=0;for(let r of e)t(r)&&n++;return n}function Va(e,t,n,r){let i=[],a=e.filter(e=>e.modified.isEmpty&&e.or...
L25: `)}isStronglyEqual(e,t){return this.lines[e]===this.lines[t]}};function no(e){let t=0;for(;t<e.length&&(e.charCodeAt(t)===32||e.charCodeAt(t)===9);)t++;return t}var ro=class{constr...
L26: /* webpackIgnore: true */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/html.worker-D9ugpX4y.jsView on unpkg · L24dist/client/static/js/codemirror-DualXd8q.jsView file
7contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=R(i,t),o=a.text.length,d,f;function p(n,r){return jr(e,B(t,n),`div`,a,r)}function m(t,n,r){var i=Lr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
Findings
1 Critical3 High5 Medium3 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-DualXd8q.js
HighChild Process
HighCross File Remote Execution Contextdist/client/static/ts.worker-DvEKW8Yk.js
HighSemantic Analysis Limiteddist/client/static/js/editor.api-DMU7ntNE.js
MediumDynamic Requiredist/client/static/html.worker-D9ugpX4y.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DvEKW8Yk.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.41659843214.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @zuplo/editor@1.0.41659843214 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.