lakex-editor-react-component
React wrapper for the lakex (语雀) document editor, shipped with a mind-map custom card and a reusable CardResizer (click-to-select + drag-to-resize + delete-on-Delete).
This report shows the evidence for lakex-editor-react-component@0.1.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains concrete, automatic browser-context exfiltration to a hard-coded third-party endpoint. The postinstall patch itself appears benign but does not mitigate the import-time telemetry.
Decision evidence
public snapshot- dist/lakex-editor-react-component.cjs.js has an import-time IIFE that schedules telemetry after 1s.
- That telemetry collects location URL, title, DOM count, viewport/network data, user agent, and a hostname-derived ID.
- It POSTs collected data to hard-coded https://collect.alipay.com/yuyan/.
- package.json postinstall runs patch-package, modifying the pinned @xiangfa/mindmap dependency.
- The patch only adds a MindMap disableAutoFit option and is package-aligned.
- No Node child-process, filesystem, or credential-harvesting imports were found in the distributed code.
Source & flagged code
4 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
Findings
Affected versions and remediation
This report applies to lakex-editor-react-component@0.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing lakex-editor-react-component@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.