canvasxpress-cli@73.6.0
Node program to run canvasXpress in the command line
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe first chart instance automatically sends runtime telemetry to the package vendor’s beacon endpoint, and the inspected source shows no disclosure or opt-out. The observed fields do not establish credential or unrelated file exfiltration, so this warrants a warning rather than a publish block.
Decision evidence
public snapshot- When the first CanvasXpress instance is created, the library builds a beacon image URL containing the client value, a derived hash, and the library version.
- The beacon image is fetched from canvasxpress.org, creating runtime telemetry without an apparent disclosure or opt-out.
- The bundle includes a dynamically constructed, obfuscated function in the beacon code path.
- The package is a CLI for running CanvasXpress, and its renderer is invoked for explicit output commands.
- The beacon sends a client value, a derived hash, and a version; inspected excerpts do not show credential or file-content collection.
Source & flagged code
5 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
src/canvasXpress.jsView on unpkg · L26A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/canvasXpress.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
src/canvasXpress.jsView on unpkg · L26Findings
Affected versions and remediation
This report applies to canvasxpress-cli@73.6.0.
See all versions of canvasxpress-cli for other recorded verdicts.
- Review the evidence and your use of canvasxpress-cli@73.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.