registry / @zuplo/editor / 1.0.35244551834
@zuplo/editor@1.0.35244551834
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiSource inspection found no lifecycle scripts or confirmed malicious behavior. The flagged execution and agent-related matches resolve to editor functionality, IDE metadata, and TypeScript compiler declarations.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the package exposes its library entrypoints; the browser fallback runs when the UI initializes in a browser without the required CSS positioning support.
Impact
The inspected behavior supports editor functionality and does not establish credential theft, unauthorized account changes, persistence, or harmful system modification.
Mechanism
The fallback imports a fixed-version UI positioning library from a public CDN. The flagged agent references describe IDE metadata and cursor styling.
AI rationale
Source inspection found no lifecycle scripts or confirmed malicious behavior. The flagged execution and agent-related matches resolve to editor functionality, IDE metadata, and TypeScript compiler declarations.
Evidence
package.jsondist/chunks/chunk-HDZMPWV2.jsdist/client/static/js/editor.api2-DJi3_-IJ.jsdist/client/static/js/main-BnegpwFb.js
Network endpoints1
cdn.jsdelivr.net/npm/@floating-ui/dom@1.7.4/+esm
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json describes a local development editor and exports library entrypoints; it defines no lifecycle scripts.
- The flagged agent-related excerpt in chunk-HDZMPWV2.js is IDE protocol and file-detection metadata.
- The flagged editor.api2-DJi3_-IJ.js excerpt defines cursor theme colors.
- main-BnegpwFb.js uses a fixed-version Floating UI CDN import as a browser UI fallback.
- The flagged bundles are editor modules and workers; the eval match in ts.worker-DFduhuek.js is a TypeScript declaration, not an executable call.
Evidence against
- The browser fallback dynamically imports code from a public CDN, but the inspected code identifies a fixed-version UI positioning library and does not establish malicious behavior.
- Scanner matches for child_process and eval resolve to TypeScript compiler library text or declarations; no child-process execution was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggeddist/client/static/js/main-BnegpwFb.jsView file
1572depsCount: ${n},
L1573: deps: ${r}}`};var i={keyword:`dependencies`,type:`object`,schemaType:`object`,error:e.error,code(e){let[t,n]=a(e);o(e,t),s(e,n)}};function a({schema:e}){let t={},n={};for(let r in ...
L1574: git clone ${i.sourceRepoUrl}
High
Child Process
Package source references child process execution.
dist/client/static/js/main-BnegpwFb.jsView on unpkg · L1572•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/static/js/main-BnegpwFb.jsView on unpkgdist/client/static/js/codemirror-6ITIKbGP.jsView file
Findings
1 Critical3 High4 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighChild Processdist/client/static/js/main-BnegpwFb.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/main-BnegpwFb.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @zuplo/editor@1.0.35244551834.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.35244551834 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.