registry / @zuplo/editor / 1.0.41627942189
@zuplo/editor@1.0.41627942189
Local development editor for the Zuplo CLI
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest identifies a local development editor and contains no install lifecycle scripts. The flagged bidi sequence is escaped inside CodeMirror’s special-character regex, and the worker’s child_process match is a Node module-name list; no concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Import exposes the editor modules; callers create and serve the app through its exported API.
Impact
No malicious behavior or unauthorized data collection was identified in the reviewed source.
Mechanism
The reviewed server code builds routes from supplied interfaces. Flagged bidi characters are escaped regex literals used to recognize special characters, and the worker reference is part of a module-name list.
AI rationale
The manifest identifies a local development editor and contains no install lifecycle scripts. The flagged bidi sequence is escaped inside CodeMirror’s special-character regex, and the worker’s child_process match is a Node module-name list; no concrete attack behavior was found.
Network endpoints3
cdn.zuplo.comportal.zuplo.comzuplo.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local development editor and has no lifecycle scripts.
- The server bundle exports an editor app that accepts filesystem, preferences, asset, and change interfaces as inputs.
- The CodeMirror match represents bidi controls as escaped characters in a regex for special-character handling.
- The TypeScript worker match is a list of Node.js module names, including child_process, rather than evidence of a spawned process.
Evidence against
- The editor UI contains network requests for Zuplo services and user-configured APIs, consistent with its editor features.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/codemirror-DualXd8q.jsView file
7contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=R(i,t),o=a.text.length,d,f;function p(n,r){return jr(e,B(t,n),`div`,a,r)}function m(t,n,r){var i=Lr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/client/static/js/codemirror-DualXd8q.jsView on unpkg · L7dist/client/static/ts.worker-CpVDZSME.jsView file
6Cross-file remote execution chain: dist/client/static/ts.worker-CpVDZSME.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L6: `).slice(2).join(`
L7: `))}},ee=class extends Error{constructor(e,t){super(e),this.name=`ListenerLeakError`,this.stack=t}},te=class extends Error{constructor(e,t){super(e),this.name=`ListenerRefusalError...
L8: `||e===` `}var li=class{constructor(e,t,n){this.changes=e,this.moves=t,this.hitTimeout=n}},ui=class{constructor(e,t){this.lineRangeMapping=e,this.changes=t}};function di(e,t,n=(e,t...
...
L30: this file except in compliance with the License. You may obtain a copy of the
L31: License at http://www.apache.org/licenses/LICENSE-2.0
L32:
...
L8981: /**
L8982: * The **\`ClipboardItem\`** interface of the Clipboard API represents
Findings
1 Critical2 High4 Medium5 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-DualXd8q.js
HighChild Process
HighCross File Remote Execution Contextdist/client/static/ts.worker-CpVDZSME.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/js/main-BOf8zMpB.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/chunks/chunk-IDPBUO6V.js
Affected versions and remediation
This report applies to @zuplo/editor@1.0.41627942189.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.41627942189 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.