registry / canvasxpress-cli / 73.3.0
canvasxpress-cli@73.3.0
Node program to run canvasXpress in the command line
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe obfuscated runtime logic may relate to CanvasXpress’s stated licensing and attribution behavior, but its complete purpose could not be verified. No concrete malicious action was established, so this is a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
CanvasXpress chart construction and subsequent load completion.
Impact
No concrete data theft or destructive behavior was established; the unclear automatic code warrants caution.
Mechanism
A string passed to new Function executes in the chart instance context and defines obfuscated methods. The bundle also contains a beacon image URL, though its caller was not identified.
AI rationale
The obfuscated runtime logic may relate to CanvasXpress’s stated licensing and attribution behavior, but its complete purpose could not be verified. No concrete malicious action was established, so this is a warning rather than a publish block.
Evidence
src/canvasXpress.js
Network endpoints1
www.canvasxpress.org/assets/images/beacon.gif
Decision evidence
public snapshotAI called this Suspicious at 77.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CanvasXpress bundle constructs a dynamically generated function containing an encoded string table; the generated function executes with the chart instance as its context.
- The same bundle contains an obfuscated method invoked after chart loading, but its full behavior could not be established from the source review.
- The bundle includes a CanvasXpress beacon URL with client, digest, and version parameters; the call path for this beacon was not established.
Evidence against
- The manifest has no lifecycle scripts and describes a CLI for running CanvasXpress.
- The bundle’s license notice explains that commercial licensing controls the rendered attribution mark, which is consistent with a license-related purpose for some hidden logic.
- The CLI routes rendering commands to its I/O handler; no credential collection or unrelated host contact was identified.
Behavioral surface
CryptoDynamicRequireEvalFilesystemNetwork
Source & flagged code
5 flaggedsrc/canvasXpress.jsView file
26*/
L27: (function(b,a){if(typeof exports==="object"){a(exports)}else{(a((b.CanvasXpress=b.CanvasXpress||{})))}}(this,(function(){var a=(typeof CanvasXpress==="function")?CanvasXpress:null;...
L28: exports['init'] = CanvasXpress;
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkg26*/
L27: (function(b,a){if(typeof exports==="object"){a(exports)}else{(a((b.CanvasXpress=b.CanvasXpress||{})))}}(this,(function(){var a=(typeof CanvasXpress==="function")?CanvasXpress:null;...
L28: exports['init'] = CanvasXpress;
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
2 High4 Medium6 Low
HighObfuscated Payload Loadersrc/canvasXpress.js
HighSemantic Analysis Limitedsrc/canvasXpress.js
MediumDynamic Requireindex.js
MediumNetwork
MediumShips Build Helper.github/scripts/triage_issue.py
MediumStructural Risk Force Deep Review
LowEvalsrc/canvasXpress.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to canvasxpress-cli@73.3.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@73.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.