registry / @zuplo/editor / 1.0.38918219187
@zuplo/editor@1.0.38918219187
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest exposes local editor modules and has no install lifecycle hook. Inspection of the flagged `.cursor` locations and required bundles found ordinary editor behavior, with no concrete attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer uses the local editor or its browser interface.
Impact
No malicious effect was identified.
Mechanism
The editor reads and saves a selected editor preference, builds an editor-open URL, and loads browser workers and editor assets.
AI rationale
The manifest exposes local editor modules and has no install lifecycle hook. Inspection of the flagged `.cursor` locations and required bundles found ordinary editor behavior, with no concrete attack surface.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports the editor modules and contains no install lifecycle hook.
- The `.cursor` match identifies Cursor for editor detection; the route reads a saved editor preference, and the browser bundle styles editor cursor elements.
- The browser app loads the editor list and saved preference, and submits the user's selected editor preference.
- The client bundle maps to editor assets; the JSON and TypeScript files are browser workers, and CodeMirror uses a zero-width character for text layout.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/main-rOu1II2H.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/static/js/main-rOu1II2H.jsView on unpkg9`+e.stack}}var me=Object.prototype.hasOwnProperty,he=t.unstable_scheduleCallback,ge=t.unstable_cancelCallback,_e=t.unstable_shouldYield,ve=t.unstable_requestPaint,ye=t.unstable_now...
L10: `).replace(Od,``)}function Ad(e,t){return t=kd(t),kd(e)===t}function jd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Vt(e,r):(typeof...
L11: `,``):String(n.body);return{path:t,submission:{formMethod:i,formAction:a,formEncType:n.formEncType,formData:void 0,json:void 0,text:e}}}else if(n.formEncType===`application/json`){...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-rOu1II2H.jsView on unpkg · L9dist/client/static/js/codemirror-6ITIKbGP.js
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/main-rOu1II2H.js
MediumDynamic Requiredist/client/static/js/main-rOu1II2H.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.38918219187.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.38918219187 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.