canvasxpress-cli@69.5.0
⚠ Under reviewNode program to run canvasXpress in the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package metadata and command sources show a user-invoked CanvasXpress renderer with no install-time mutation, harvesting, or hidden payload execution. The required chart library src/canvasXpress.js is unreadable binary with no searchable source text, so a clean or warning verdict cannot be grounded in that file.
Decision evidence
public snapshot- package.json names the canvasxpress bin and lists only charting CLI dependencies, with no preinstall, install, or postinstall scripts.
- index.js runs only when the user starts the bin and then dispatches named commands such as png, svg, json, help, or version.
- cmds/io.js launches Playwright against the bundled local HTML template or a user-supplied page and saves chart downloads under the chosen output path.
- src/canvasXpress.js is reported as a binary file and literal searches for ordinary script text return no matches, so that required library could not be reviewed.
- No child_process, eval, credential, or environment harvesting appears in the readable entrypoints.
- Network URLs in the readable sources are canvasxpress.org examples, GitHub links, or caller-supplied input pages.
- The dynamic require of a user path is limited to the explicit canvas command.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@69.5.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@69.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.