registry  /  kritzel-stencil  /  0.3.32

kritzel-stencil@0.3.32

Kritzel helps you build infinite whiteboard experiences.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Observed network and storage primitives support a whiteboard/collaboration library and require runtime host/user configuration or user actions.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the package or using exported whiteboard components/providers.
Impact
No malicious impact identified by static source inspection.
Mechanism
Benign UI, collaboration sync, asset storage, and offline license verification code.
Rationale
Static inspection shows a Stencil whiteboard component package with expected collaboration, asset upload, local storage, and license-validation primitives, not unconsented execution or exfiltration. Scanner findings appear to be noisy matches on bundled dependencies, wrapper require statements, URLs in documentation/defaults, and license comments.
Evidence
package.jsondist/index.cjs.jsdist/index.jsloader/index.jsloader/index.cjs.jsdist/esm/schema.constants-CH2FWTVr.jsdist/cjs/schema.constants-DItwOm2z.jsdist/collection/classes/providers/sync/websocket-sync-provider.class.jsdist/collection/classes/providers/sync/hocuspocus-sync-provider.class.jsdist/collection/classes/providers/assets/http-asset-provider.class.jsdist/collection/classes/providers/assets/presigned-asset-provider.class.jsdist/collection/classes/managers/license.manager.js
Network endpoints2
ws://localhost:1234cdn.jsdelivr.net/npm/browser-image-compression@2.0.2/dist/browser-image-compression.js

Decision evidence

public snapshot
AI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json has no install/preinstall/postinstall/prepare lifecycle scripts; published entrypoints are dist/index.cjs.js and dist/index.js.
    • dist/index.cjs.js and loader/index.cjs.js only delegate to bundled CJS files; no install-time execution or shell execution found.
    • Trojan Source check over dist/esm/schema.constants-CH2FWTVr.js and dist/cjs/schema.constants-DItwOm2z.js found no bidi/invisible control characters.
    • Network code is package-aligned: optional collaboration providers default to ws://localhost:1234 and asset providers use host-supplied URLs.
    • License code verifies an offline Ed25519 public key and schedules local revalidation; it does not exfiltrate keys or credentials.
    • Searches found no child_process, credential harvesting, persistence, destructive file writes, or AI-agent control-surface mutation.
    Behavioral surface
    Source
    ChildProcessDynamicRequireNetwork
    Supply chain
    HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
    ManifestNo manifest risk signals triggered.
    scanned 325 file(s), 9.14 MB of source, external domains: bugs.chromium.org, bugs.webkit.org, cdn.jsdelivr.net, chat.stenciljs.com, code.haverbeke.berlin, commonmark.org, developer.microsoft.com, developer.mozilla.org, ecma-international.org, eev.ee, en.wikipedia.org, github.com, golang.org, kritzel.io, mathiasbynens.be, npms.io, prosemirror.net, stackoverflow.com, stenciljs.com, w3c.github.io, www.awsarchitectureblog.com, www.stum.de, www.w3.org

    Source & flagged code

    3 flagged · loading source
    dist/index.cjs.jsView file
    1module.exports = require('./cjs/index.cjs.js');
    Medium
    Dynamic Require

    Package source references dynamic require/import behavior.

    dist/index.cjs.jsView on unpkg · L1
    dist/esm/schema.constants-CH2FWTVr.jsView file
    2602contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite
    Critical
    Trojan Source Unicode

    Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

    dist/esm/schema.constants-CH2FWTVr.jsView on unpkg · L2602
    dist/cjs/schema.constants-DItwOm2z.jsView file
    •Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/cjs/index.cjs.js -> dist/cjs/schema.constants-DItwOm2z.js Reachable file contains a blocking source-risk pattern.
    Critical
    Trigger Reachable Dangerous Capability

    A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

    dist/cjs/schema.constants-DItwOm2z.jsView on unpkg

    Findings

    2 Critical4 Medium4 Low
    CriticalTrojan Source Unicodedist/esm/schema.constants-CH2FWTVr.js
    CriticalTrigger Reachable Dangerous Capabilitydist/cjs/schema.constants-DItwOm2z.js
    MediumDynamic Requiredist/index.cjs.js
    MediumNetwork
    MediumProtestware
    MediumStructural Risk Force Deep Review
    LowScripts Present
    LowObfuscated
    LowHigh Entropy Strings
    LowUrl Strings