OpenSSF/OSV advisory MAL-2026-4656 confirms this npm version as malicious. The package's rich-text editor module hardcodes an Azure OpenAI endpoint (https://aidevused.openai.azure.com/) and an api-key in esm2015/lib/form/richtexteditor/ai-config.js (and in the UMD bundle bundles/raise-common-lib.umd.js around lines 38398-38416)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in raise-common-lib (npm)
Details
The package's rich-text editor module hardcodes an Azure OpenAI endpoint (https://aidevused.openai.azure.com/) and an api-key in esm2015/lib/form/richtexteditor/ai-config.js (and in the UMD bundle bundles/raise-common-lib.umd.js around lines 38398-38416). When a consuming application invokes the editor's AI features (Rephrase / Grammar / Summarize / Translate / SentimentAnalysis via OpenAiModelRTE, getAzureChatAIRequest, getAzureTextAIRequest), the user-supplied text is fetch-POSTed to that endpoint with the embedded api-key header. The destination is not configurable by the installer or the consumer's end user, so any text passed through the AI editor actions is routed to a third-party Azure account controlled by the package author. Two installer-impacting consequences result: (1) caller-supplied editor content is silently relayed to an account the installer never agreed to send data to, and (2) the embedded Azure OpenAI api-key ships in every consumer bundle, so anyone who installs the package can extract the key and use it against Azure (consuming quota, abusing billing, or impersonating that account when querying logs).
Decision reason
OpenSSF Malicious Packages via OSV confirms raise-common-lib@0.0.249 as malicious (MAL-2026-4656): Malicious code in raise-common-lib (npm)