registry / @zuplo/editor / 1.0.36798003175
@zuplo/editor@1.0.36798003175
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest declares no lifecycle scripts, and the inspected agent-related locations are benign editor data and styling. Bundle structure and scanner labels alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The package exposes editor entry points; no install lifecycle trigger is declared.
Impact
No harmful effect was established.
Mechanism
The inspected agent-related matches describe IDE URL templates and Monaco cursor colors, with no agent configuration mutation.
AI rationale
The manifest declares no lifecycle scripts, and the inspected agent-related locations are benign editor data and styling. Bundle structure and scanner labels alone do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies a local development editor and exposes JavaScript entry points; no lifecycle scripts are declared.
- The flagged chunk location contains IDE deep-link metadata for Cursor and WebStorm.
- The second flagged location contains Monaco cursor color rules.
- The main and companion bundles reference editor and worker chunks; the worker files contain bundled editor code.
- No confirmed attack behavior was identified in the inspected source.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/main-7HymC6Qo.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/static/js/main-7HymC6Qo.jsView on unpkg12L13: Please change the parent <Route path="${e}"> to <Route path="${e===`/`?`*`:`${e}/*`}">.`)}let f=to(),p;if(t){let e=typeof t==`string`?jr(t):t;Tr(u===`/`||e.pathname?.startsWith(u),...
L14: `);for(;n!==-1;){let e=s.slice(0,n);s=s.slice(n+1),e.trim()&&(yield i(e)),n=s.indexOf(`
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-7HymC6Qo.jsView on unpkg · L12dist/client/static/js/codemirror-6ITIKbGP.jsView file
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/main-7HymC6Qo.js
MediumDynamic Requiredist/client/static/js/main-7HymC6Qo.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.36798003175.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.36798003175 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.