canvasxpress-cli@73.4.0
Node program to run canvasXpress in the command line
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe bundle contains automatically invoked obfuscated code, but its surrounding logic and license metadata are consistent with the library's documented attribution and license checks. The inspected CLI behavior is ordinary chart rendering and export, with no credential theft, unrelated data collection, or destructive action identified.
Decision evidence
public snapshot- The manifest exposes a CLI executable and declares no lifecycle scripts.
- The bundled library identifies itself as CanvasXpress and describes its rendered attribution mark and licensing terms.
- The obfuscated inline function is part of the chart constructor; adjacent library code provides license and valid-domain fields, consistent with attribution enforcement.
- The CLI dispatches export work through explicit commands such as png, svg, json, and reproduce.
- The chart bundle contains a large obfuscated function built with new Function and invoked during construction; its implementation is difficult to audit directly.
- The CLI and browser bundle can access local files and network resources as part of rendering user-selected charts.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@73.4.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@73.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.