registry / @zuplo/editor / 1.0.41490136035
@zuplo/editor@1.0.41490136035
Local development editor for the Zuplo CLI
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package metadata and source match a local development editor. Its server starts through an explicit method, and the reviewed network calls serve test-request and schema-loading features; the scanner’s Unicode finding is a regex for displaying special characters.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer explicitly starts the local editor server; test requests and schema loading occur through editor routes.
Impact
Expected editor behavior; no automatic credential collection, unrelated data transfer, or install-time action was identified.
Mechanism
The editor serves its UI and project APIs, forwards caller-supplied test requests, and fetches schemas from cdn.zuplo.com.
AI rationale
The package metadata and source match a local development editor. Its server starts through an explicit method, and the reviewed network calls serve test-request and schema-loading features; the scanner’s Unicode finding is a regex for displaying special characters.
Network endpoints2
cdn.zuplo.comCaller-supplied HTTP(S) test request URL
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local development editor and exposes editor modules; it defines no lifecycle scripts.
- The HTTP server is started through an explicit `LocalEditorServer.start()` method.
- The test proxy accepts an HTTP(S) URL in its request body and forwards that test request.
- Schema requests fetch from Zuplo’s CDN.
- The flagged Unicode sequences are escaped characters in a CodeMirror regex that handles special characters.
Evidence against
- The editor includes filesystem and network capabilities, but they serve project editing, test requests, and schema loading.
- The test proxy can forward requests to caller-supplied HTTP(S) destinations.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/codemirror-DualXd8q.jsView file
7contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=R(i,t),o=a.text.length,d,f;function p(n,r){return jr(e,B(t,n),`div`,a,r)}function m(t,n,r){var i=Lr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/client/static/js/codemirror-DualXd8q.jsView on unpkg · L7dist/client/static/ts.worker-CpVDZSME.jsView file
6Cross-file remote execution chain: dist/client/static/ts.worker-CpVDZSME.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L6: `).slice(2).join(`
L7: `))}},ee=class extends Error{constructor(e,t){super(e),this.name=`ListenerLeakError`,this.stack=t}},te=class extends Error{constructor(e,t){super(e),this.name=`ListenerRefusalError...
L8: `||e===` `}var li=class{constructor(e,t,n){this.changes=e,this.moves=t,this.hitTimeout=n}},ui=class{constructor(e,t){this.lineRangeMapping=e,this.changes=t}};function di(e,t,n=(e,t...
...
L30: this file except in compliance with the License. You may obtain a copy of the
L31: License at http://www.apache.org/licenses/LICENSE-2.0
L32:
...
L8981: /**
L8982: * The **\`ClipboardItem\`** interface of the Clipboard API represents
Findings
1 Critical2 High4 Medium5 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-DualXd8q.js
HighChild Process
HighCross File Remote Execution Contextdist/client/static/ts.worker-CpVDZSME.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/js/main-CY4Zq3l6.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zuplo/editor@1.0.41490136035.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.41490136035 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.