registry / @zuplo/editor / 1.0.35253608947
@zuplo/editor@1.0.35253608947
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiSource inspection found no install lifecycle hooks and no concrete attack behavior. The flagged child-process and invisible-character matches resolve to editor-related source contexts.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Using the editor package or loading its browser editor assets.
Impact
No package-controlled credential transfer, destructive action, or remote execution was established.
Mechanism
The UI reads editor choices and saved preferences through local routes; bundled worker and editor code contains the flagged strings in normal editor contexts.
AI rationale
Source inspection found no install lifecycle hooks and no concrete attack behavior. The flagged child-process and invisible-character matches resolve to editor-related source contexts.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports the editor runtime and contains no lifecycle script entry.
- The editor UI fetches local editor-list and saved-preference routes; the server returns stored editor preferences and validated editor details.
- The TypeScript worker includes `child_process` in a string of recognized Node built-in module names; the surrounding code checks imports.
- CodeMirror uses a zero-width space to measure browser rendering dimensions.
Evidence against
- Scanner flagged child-process use and invisible Unicode, but inspected source ties those matches to a worker module-name list and CodeMirror’s rendering measurement.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/client/static/js/main-BnegpwFb.jsView file
1572depsCount: ${n},
L1573: deps: ${r}}`};var i={keyword:`dependencies`,type:`object`,schemaType:`object`,error:e.error,code(e){let[t,n]=a(e);o(e,t),s(e,n)}};function a({schema:e}){let t={},n={};for(let r in ...
L1574: git clone ${i.sourceRepoUrl}
High
Child Process
Package source references child process execution.
dist/client/static/js/main-BnegpwFb.jsView on unpkg · L1572•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/static/js/main-BnegpwFb.jsView on unpkgdist/client/static/js/codemirror-6ITIKbGP.jsView file
Findings
1 Critical3 High4 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighChild Processdist/client/static/js/main-BnegpwFb.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/main-BnegpwFb.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @zuplo/editor@1.0.35253608947.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.35253608947 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.