registry / @zuplo/editor / 1.0.38373921396
@zuplo/editor@1.0.38373921396
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no install lifecycle script, and the inspected agent-integration locations map to editor behavior rather than agent configuration changes. The scanner hints do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The package exposes its editor modules to consumers; the test console opens through a user action.
Impact
No harmful effect was established in the inspected source.
Mechanism
The backend offers editor-launch links and saves a validated editor preference. The flagged client locations concern Monaco cursor styling and editor-worker behavior.
AI rationale
The manifest has no install lifecycle script, and the inspected agent-integration locations map to editor behavior rather than agent configuration changes. The scanner hints do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 80.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest exports editor modules and contains no install lifecycle script.
- The backend defines standard editor launch links and validates saved editor preferences.
- The indicated client bundle location styles Monaco editor cursors; it does not write agent configuration.
- The editor UI exposes the test console through a user action, while the client bundle defines Zuplo API routes.
- The Unicode match is CodeMirror’s special-character handling, and the TypeScript worker loads a configured custom editor worker.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/main-LQGYa7z0.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/static/js/main-LQGYa7z0.jsView on unpkg9`+e.stack}}var me=Object.prototype.hasOwnProperty,he=t.unstable_scheduleCallback,ge=t.unstable_cancelCallback,_e=t.unstable_shouldYield,ve=t.unstable_requestPaint,ye=t.unstable_now...
L10: `).replace(Od,``)}function Ad(e,t){return t=kd(t),kd(e)===t}function jd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Vt(e,r):(typeof...
L11: `,``):String(n.body);return{path:t,submission:{formMethod:i,formAction:a,formEncType:n.formEncType,formData:void 0,json:void 0,text:e}}}else if(n.formEncType===`application/json`){...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-LQGYa7z0.jsView on unpkg · L9dist/client/static/js/codemirror-6ITIKbGP.js
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/main-LQGYa7z0.js
MediumDynamic Requiredist/client/static/js/main-LQGYa7z0.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.38373921396.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.38373921396 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.