canvasxpress-cli@71.8.0
Node program to run canvasXpress in the command line
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the CLI's network-capable rendering path is invoked through explicit commands and uses the requested input. The browser bundle contains opaque obfuscated code, but its inspected context ties behavior to CanvasXpress branding and product endpoints; no concrete attack was established.
Decision evidence
public snapshot- package.json declares a CLI binary and dependencies but no lifecycle scripts.
- The binary invokes the CLI; index.js dispatches named commands to their handlers.
- cmds/io.js loads the supplied input or the bundled chart page for rendering.
- The browser library configures CanvasXpress client and domain settings and its own service endpoint.
- The library beacon uses a CanvasXpress URL and its client value.
- The export code applies CanvasXpress branding when its validity setting is absent.
- src/canvasXpress.js contains an immediately executed obfuscated Function, so its internal behavior is not transparent from the inspected excerpt.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@71.8.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@71.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.