canvasxpress-cli@72.7.0
Node program to run canvasXpress in the command line
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no install hook or concrete attack behavior. The flagged dynamic code path is part of CanvasXpress function serialization, and the dependency snapshots support the CLI’s stated terminal and rendering functions.
Decision evidence
public snapshot- The manifest exposes a command line entrypoint and lists the package’s runtime dependencies; it configures no install lifecycle.
- The bundle exports CanvasXpress functionality. Its eval path is limited to parsing strings marked as serialized functions, matching the library’s function serialization code.
- The inspected dependency snapshots implement terminal styling, terminal clearing, and FIGfont rendering; their manifests and entry files show no install behavior.
- The CLI uses these dependencies for its banner and invokes rendering commands through the user-run command line entrypoint.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@72.7.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@72.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.