registry / @zuplo/editor / 1.0.36861937463
@zuplo/editor@1.0.36861937463
⚠ Under reviewLocal development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe inspected manifest has no lifecycle hooks, and the flagged agent-configuration locations are IDE protocol metadata and editor styling. Large browser bundles were not fully resolved, so the source review does not support a confident clean or malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Unresolved behavior, if present, would be reached through browser bundle execution; no specific trigger was confirmed.
Impact
No specific harmful effect was confirmed; the incomplete bundle review leaves residual uncertainty.
Mechanism
The package exports a local editor app, while its large client bundles could not be fully assessed within bounded source inspection.
AI rationale
The inspected manifest has no lifecycle hooks, and the flagged agent-configuration locations are IDE protocol metadata and editor styling. Large browser bundles were not fully resolved, so the source review does not support a confident clean or malicious verdict.
Evidence
dist/client/static/js/main-DY4FmpMZ.jsdist/client/static/js/GraphiQLConsole-l7akcm2T.jsdist/client/static/js/dist-BS3XJtjt.jsdist/client/static/json.worker-C4s5qRoG.jsdist/client/static/js/codemirror-6ITIKbGP.jsdist/client/static/ts.worker-DFduhuek.jspackage.jsondist/index.jsdist/chunks/chunk-7QJXNUVM.jsdist/client/static/js/editor.api2-DJi3_-IJ.js
Network endpoints1
cdn.zuplo.com
Decision evidence
public snapshotAI called this Manual Review at 57.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json exposes editor APIs and declares no lifecycle scripts.
- The main entry imports the editor app and path-safety utilities.
- The flagged editor configuration bytes describe IDE protocols and cursor styling.
- The server proxies test requests and fetches schemas from Zuplo’s CDN.
- Large browser bundles remain only partially inspected, so their behavior is unresolved.
Evidence against
- The inspected manifest has no install-time hook; the cited runtime network calls serve test proxying and schema retrieval.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/main-DY4FmpMZ.jsView file
9`+e.stack}}var me=Object.prototype.hasOwnProperty,he=t.unstable_scheduleCallback,ge=t.unstable_cancelCallback,_e=t.unstable_shouldYield,ve=t.unstable_requestPaint,ye=t.unstable_now...
L10: `).replace(Dd,``)}function kd(e,t){return t=Od(t),Od(e)===t}function Ad(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Bt(e,r):(typeof...
L11: `,``):String(n.body);return{path:t,submission:{formMethod:i,formAction:a,formEncType:n.formEncType,formData:void 0,json:void 0,text:e}}}else if(n.formEncType===`application/json`){...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-DY4FmpMZ.jsView on unpkg · L9dist/client/static/js/codemirror-6ITIKbGP.jsView file
7contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=R(i,t),o=a.text.length,d,f;function p(n,r){return jr(e,B(t,n),`div`,a,r)}function m(t,n,r){var i=Lr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==
Critical
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/GraphiQLConsole-l7akcm2T.js
MediumDynamic Requiredist/client/static/js/main-DY4FmpMZ.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.36861937463.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.36861937463 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.