registry / lakex-editor-react-component / 0.1.0

lakex-editor-react-component@0.1.0

React wrapper for the lakex (语雀) document editor, shipped with a mind-map custom card and a reusable CardResizer (click-to-select + drag-to-resize + delete-on-Delete).

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Browser import triggers a delayed telemetry report to a hard-coded third-party endpoint. The report includes page and browser metadata without a component prop or user action enabling it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing the package entry in a browser-capable environment.

Impact

Exfiltrates page URL/title and browser context to a third party.

Mechanism

Import-time collection and POST/beacon telemetry.

Attack narrative

The bundled entry executes an import-time IIFE that calls setTimeout and then invokes telemetry. Its reporting function builds data from location.href, document.title, DOM count, screen/network data, user agent, and hostname-derived identity, then POSTs it to collect.alipay.com. This occurs independently of editor use or an exposed opt-in setting.

Rationale

The package contains concrete, automatic browser-context exfiltration to a hard-coded third-party endpoint. The postinstall patch itself appears benign but does not mitigate the import-time telemetry.

Evidence

dist/lakex-editor-react-component.cjs.jspackage.jsonpatches/@xiangfa+mindmap+0.7.1.patchREADME.md

Network endpoints1

collect.alipay.com/yuyan/

Decision evidence

public snapshot

lakex-editor-react-component@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code