canvasxpress-cli@70.2.0
Node program to run canvasXpress in the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe manifest has no lifecycle hooks, and the referenced chart library matches the package's CLI visualization purpose. Dynamic require, eval, and network reads are gated by an explicit user command and do not form a hidden install chain.
Decision evidence
public snapshot- package.json 70.2.0 exposes only the canvasxpress bin and ordinary CLI dependencies, with no preinstall, install, or postinstall scripts.
- src/canvasXpress.js is the CanvasXpress 70.2 charting library loaded by the local HTML template when the user runs the CLI.
- The canvas command can require a user-supplied script path, and the chart library uses eval for caller-supplied callbacks and XMLHttpRequest GET for chart data URLs. Those run only after an explicit CLI invocation.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@70.2.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@70.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.