canvasxpress-cli@70.7.0
Node program to run canvasXpress in the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected entrypoints and library behavior support the package's chart-rendering purpose, with no automatic install execution or concrete malicious chain. Dynamic execution and network access are package-aligned or explicitly user-invoked.
Decision evidence
public snapshot- package.json has no lifecycle hooks or runtime self-dependency.
- src/canvasXpress.js retrieves chart data with ordinary HTTP GET requests.
- index.js loads a caller-selected script only through the explicit canvas command.
- cmds/io.js renders the caller's input URL or the bundled chart template.
- The library's image beacon targets the CanvasXpress service; inspected code showed no credential harvesting.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@70.7.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@70.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.