raise-common-lib
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 8.2.14.
This report shows the evidence for raise-common-lib@0.0.249. 1 of 12 known versions is blocked or flagged. The newest version, 0.0.263, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-4656 confirms this npm version as malicious.
Advisory
MAL-2026-4656
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in raise-common-lib (npm)
Details
The package's rich-text editor module hardcodes an Azure OpenAI endpoint (https://aidevused.openai.azure.com/) and an api-key in esm2015/lib/form/richtexteditor/ai-config.js (and in the UMD bundle bundles/raise-common-lib.umd.js around lines 38398-38416). When a consuming application invokes the editor's AI features (Rephrase / Grammar / Summarize / Translate / SentimentAnalysis via OpenAiModelRTE, getAzureChatAIRequest, getAzureTextAIRequest), the user-supplied text is fetch-POSTed to that endpoint with the embedded api-key header. The destination is not configurable by the installer or the consumer's end user, so any text passed through the AI editor actions is routed to a third-party Azure account controlled by the package author. Two installer-impacting consequences result: (1) caller-supplied editor content is silently relayed to an account the installer never agreed to send data to, and (2) the embedded Azure OpenAI api-key ships in every consumer bundle, so anyone who installs the package can extract the key and use it against Azure (consuming quota, abusing billing, or impersonating that account when querying logs).
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to raise-common-lib@0.0.249.
The versions list below shows the verdict for each recorded version.
- Avoid installing raise-common-lib@0.0.249. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.