canvasxpress-cli@72.3.0
⚠ Under reviewNode program to run canvasXpress in the command line
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe inspected CLI source shows user-invoked rendering and a dynamic module load selected by the user, while the bundle’s eval path handles marked serialized event functions. Runtime dependency source for figlet and Playwright is unavailable in the snapshot, so the review cannot resolve all runtime behavior.
Decision evidence
public snapshot- package.json declares figlet and playwright as runtime dependencies.
- The CLI entrypoint imports figlet when it loads.
- The render command loads Playwright and opens a target URL supplied through the CLI input.
- The canvas command dynamically loads a module at the user-supplied input path.
- The bundle’s eval path is gated on serialized function values in event data.
- The manifest has no install lifecycle scripts.
- The inspected source does not establish credential collection, unauthorized account actions, or a publisher-selected network recipient.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@72.3.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@72.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.