registry  /  kritzel-stencil  /  0.3.31

kritzel-stencil@0.3.31

Kritzel helps you build infinite whiteboard experiences.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Risky primitives are part of a browser whiteboard component: collaboration sync, asset storage, clipboard, local persistence, and offline license/watermark handling.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime use of configured Kritzel editor features by the host application.
Impact
No evidence of credential theft, unconsented execution, exfiltration, or install-time behavior.
Mechanism
Consumer-configured collaboration/assets and local browser storage APIs.
Rationale
Static source inspection shows a legitimate Stencil whiteboard library with package-aligned browser capabilities and no install-time/import-time malicious behavior. Scanner findings appear driven by bundled dependencies, configurable network providers, and license/watermark logic rather than concrete attack code.
Evidence
package.jsondist/index.cjs.jsdist/index.jsdist/esm/index.jsdist/collection/classes/providers/sync/websocket-sync-provider.class.jsdist/collection/classes/providers/sync/hocuspocus-sync-provider.class.jsdist/collection/classes/providers/assets/http-asset-provider.class.jsdist/collection/classes/providers/assets/presigned-asset-provider.class.jsdist/collection/classes/managers/license.manager.js
Network endpoints3
ws://localhost:1234cdn.jsdelivr.net/npm/browser-image-compression@2.0.2/dist/browser-image-compression.jskritzel.io

Decision evidence

public snapshot
AI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for block
  • Network-capable WebSocket/Hocuspocus and HTTP asset providers exist in dist/collection/classes/providers/*.
  • Bundled browser-image-compression code can load worker script from https://cdn.jsdelivr.net/npm/browser-image-compression@2.0.2/dist/browser-image-compression.js.
  • Clipboard/localStorage/indexedDB APIs are present for editor copy/paste, settings, workspaces, and local persistence.
Evidence against
  • package.json has no install/preinstall/postinstall lifecycle hooks; main/module are dist entrypoint re-exports.
  • Entrypoints dist/index.cjs.js and dist/index.js only load bundled library code, not installer/import-time shell or exfiltration logic.
  • Network URLs are consumer-configured or package-aligned defaults like ws://localhost:1234 for collaboration/assets, not hardcoded attacker endpoints.
  • License manager in dist/collection/classes/managers/license.manager.js performs offline Ed25519 public-key verification and local timer rechecks only.
  • Trojan-source check found no bidi/invisible control characters in highlighted schema files.
  • No child_process, credential harvesting, destructive filesystem operations, persistence, or AI-agent control-surface writes found.
Behavioral surface
Source
ChildProcessDynamicRequireNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 319 file(s), 9.12 MB of source, external domains: bugs.chromium.org, bugs.webkit.org, cdn.jsdelivr.net, chat.stenciljs.com, code.haverbeke.berlin, commonmark.org, developer.microsoft.com, developer.mozilla.org, ecma-international.org, eev.ee, en.wikipedia.org, github.com, golang.org, kritzel.io, mathiasbynens.be, npms.io, prosemirror.net, stackoverflow.com, stenciljs.com, w3c.github.io, www.awsarchitectureblog.com, www.stum.de, www.w3.org

Source & flagged code

3 flagged · loading source
dist/index.cjs.jsView file
1module.exports = require('./cjs/index.cjs.js');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1
dist/esm/schema.constants-CH2FWTVr.jsView file
2602contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/esm/schema.constants-CH2FWTVr.jsView on unpkg · L2602
dist/cjs/schema.constants-DItwOm2z.jsView file
•Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/cjs/index.cjs.js -> dist/cjs/schema.constants-DItwOm2z.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/schema.constants-DItwOm2z.jsView on unpkg

Findings

2 Critical4 Medium4 Low
CriticalTrojan Source Unicodedist/esm/schema.constants-CH2FWTVr.js
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/schema.constants-DItwOm2z.js
MediumDynamic Requiredist/index.cjs.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings