registry / @zuplo/editor / 1.0.37479372976
@zuplo/editor@1.0.37479372976
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe package manifest identifies a local editor and contains no lifecycle scripts. The required source locations support normal editor and worker behavior; scanner labels alone do not establish malicious activity.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the published modules or loading the editor assets.
Impact
No malicious effect was established from the inspected source.
Mechanism
The manifest exposes built modules without lifecycle scripts; inspected bundle excerpts show editor protocol metadata, browser asset mappings, and worker/editor support code.
AI rationale
The package manifest identifies a local editor and contains no lifecycle scripts. The required source locations support normal editor and worker behavior; scanner labels alone do not establish malicious activity.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies a local development editor and exposes its built modules; it declares no lifecycle scripts.
- The server bundle location describes editor-opening protocols and detected IDE files.
- The browser bundle location contains Monaco cursor styling rules.
- The main and secondary browser bundles begin with Vite asset dependency maps.
- The JSON worker begins with error handling and listener setup; the TypeScript worker begins with module export boilerplate.
- The CodeMirror bundle matches invisible and bidirectional Unicode characters for special-character handling.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/main-C9S4WURX.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/static/js/main-C9S4WURX.jsView on unpkg9`+e.stack}}var me=Object.prototype.hasOwnProperty,he=t.unstable_scheduleCallback,ge=t.unstable_cancelCallback,_e=t.unstable_shouldYield,ve=t.unstable_requestPaint,ye=t.unstable_now...
L10: `).replace(gd,``)}function vd(e,t){return t=_d(t),_d(e)===t}function yd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Bt(e,r):(typeof...
L11: `,``):String(n.body);return{path:t,submission:{formMethod:i,formAction:a,formEncType:n.formEncType,formData:void 0,json:void 0,text:e}}}else if(n.formEncType===`application/json`){...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-C9S4WURX.jsView on unpkg · L9dist/client/static/js/codemirror-6ITIKbGP.js
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/main-C9S4WURX.js
MediumDynamic Requiredist/client/static/js/main-C9S4WURX.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.37479372976.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.37479372976 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.