registry / @zuplo/editor / 1.0.40379000583
@zuplo/editor@1.0.40379000583
Local development editor for the Zuplo CLI
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s inspected behavior matches a local development editor: it serves a client, watches project files, and performs request and schema operations when used. The scanner flags resolve to ordinary editor code, and I found no malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Consumers explicitly start the exported local editor server; proxy requests and schema lookups occur when the editor handles those requests.
Impact
These operations support local editing and testing; the inspected source shows no automatic credential collection, unrelated data transmission, or concealed execution.
Mechanism
The server watches the configured project directory, stores editor preference data, serves bundled client assets, proxies test requests to their supplied URLs, and fetches schemas from the Zuplo CDN.
AI rationale
The package’s inspected behavior matches a local development editor: it serves a client, watches project files, and performs request and schema operations when used. The scanner flags resolve to ordinary editor code, and I found no malicious behavior.
Evidence
$XDG_CONFIG_HOME/zuplo/editor.json~/.config/zuplo/editor.json
Network endpoints2
cdn.zuplo.comHTTP(S) URL supplied in a test request
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local development editor and exposes JavaScript entry points; its package configuration contains no lifecycle scripts.
- The exported server starts its listener only when its start method is called, using the configured host and port.
- The test proxy forwards a request to the URL supplied in the request body, consistent with a local development editor feature.
- The schema route fetches schema files from the Zuplo CDN.
- The flagged CodeMirror bundle uses a zero-width space in editor layout and input handling; the flagged TypeScript worker contains TypeScript language-service code.
Evidence against
- The package has filesystem access for editor preferences and watches the configured project directory, consistent with its stated purpose.
- The worker’s child_process match is part of a built-in list of Node module names, not evidence of spawning a process.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggeddist/client/static/js/main-DvuJqgyC.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/static/js/main-DvuJqgyC.jsView on unpkg9`+e.stack}}var pe=Object.prototype.hasOwnProperty,me=t.unstable_scheduleCallback,he=t.unstable_cancelCallback,ge=t.unstable_shouldYield,_e=t.unstable_requestPaint,ve=t.unstable_now...
L10: `).replace(_d,``)}function yd(e,t){return t=vd(t),vd(e)===t}function bd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||zt(e,r):(typeof...
L11: `,``):String(n.body);return{path:t,submission:{formMethod:i,formAction:a,formEncType:n.formEncType,formData:void 0,json:void 0,text:e}}}else if(n.formEncType===`application/json`){...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-DvuJqgyC.jsView on unpkg · L9dist/client/static/js/codemirror-6ITIKbGP.js
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/main-DvuJqgyC.js
MediumDynamic Requiredist/client/static/js/main-DvuJqgyC.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.40379000583.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.40379000583 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.