registry / @zuplo/editor / 1.0.36696540488
@zuplo/editor@1.0.36696540488
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts, and inspected runtime behavior aligns with local editor functionality. The agent-integration locations concern IDE detection and cursor styling, not agent settings mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Using the local editor and its editor-related features.
Impact
No malicious effect or unconsented agent configuration change was established.
Mechanism
The client loads bundled language workers, can load a custom worker when configured, and checks a supplied GraphiQL URL for content-type metadata.
AI rationale
The manifest has no lifecycle scripts, and inspected runtime behavior aligns with local editor functionality. The agent-integration locations concern IDE detection and cursor styling, not agent settings mutation.
Decision evidence
public snapshotAI called this Clean at 85.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes editor modules and includes no lifecycle scripts.
- The server bundle’s IDE entries detect Cursor and JetBrains IDEs through project markers and provide their open-file URL schemes.
- The editor bundle styles cursor classes, and CodeMirror uses a zero-width space for layout and input handling.
- The client loads bundled language workers; the GraphiQL component makes a HEAD request to read content-type metadata for its URL.
- The TypeScript worker loads a custom script only when a custom worker path is supplied.
Evidence against
- Network and dynamic-loading matches correspond to editor functionality: URL metadata lookup and an optional custom worker path.
- The agent-integration hints point to IDE detection and editor cursor styling; these excerpts do not show agent configuration changes.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
5 flaggeddist/client/static/js/main-DkCXaW4L.jsView file
12L13: Please change the parent <Route path="${e}"> to <Route path="${e===`/`?`*`:`${e}/*`}">.`)}let f=to(),p;if(t){let e=typeof t==`string`?jr(t):t;Tr(u===`/`||e.pathname?.startsWith(u),...
L14: `);for(;n!==-1;){let e=s.slice(0,n);s=s.slice(n+1),e.trim()&&(yield i(e)),n=s.indexOf(`
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-DkCXaW4L.jsView on unpkg · L12dist/client/static/js/codemirror-6ITIKbGP.jsView file
7contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=R(i,t),o=a.text.length,d,f;function p(n,r){return jr(e,B(t,n),`div`,a,r)}function m(t,n,r){var i=Lr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/client/static/js/codemirror-6ITIKbGP.jsView on unpkg · L7Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/GraphiQLConsole-l75574op.js
MediumDynamic Requiredist/client/static/js/main-DkCXaW4L.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.36696540488.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.36696540488 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.