registry / ryugi-artifacts / 1.4.1
ryugi-artifacts@1.4.1
Server and viewer for the Ryugi artifacts app
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe required manifest and flagged source paths show ordinary application and bundled-library behavior, with no verified malicious action. Scanner similarity and analysis-limit labels do not establish an attack, and the inspected excerpts do not substantiate the flagged secret or Unicode indicators as harmful behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The build hook runs during publishing; the viewer and server behaviors activate when their application components are used or started.
Impact
No confirmed harmful effect or attack surface was established from the inspected source.
Mechanism
The viewer uses configured Excalidraw services and connects its WebSocket to the current host; the server reads caller configuration and resolves its root. The flagged diagram and math excerpts provide parsing and diagnostic behavior.
AI rationale
The required manifest and flagged source paths show ordinary application and bundled-library behavior, with no verified malicious action. Scanner similarity and analysis-limit labels do not establish an attack, and the inspected excerpts do not substantiate the flagged secret or Unicode indicators as harmful behavior.
Network endpoints2
oss-ai.excalidraw.comoss-collab.excalidraw.com
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json publishes the server and viewer artifacts; its prepublishOnly hook runs the build.
- The viewer bundle defines Excalidraw service endpoints and Firebase configuration; the app bundle opens a WebSocket at the page’s current host.
- The two KaTeX bundles contain math parse-error formatting; the color and helper chunks contain color conversion and module utility code.
- The Kurdish locale bundle contains translated interface labels, including paste and selection actions.
- The server reads configuration from process.env and command-line arguments, then resolves the configured root.
- The diagram bundles contain Mermaid parsing, diagnostics, and geometry helpers.
Evidence against
- Static scanner labels included source similarity, a secret pattern, Trojan Source, and incomplete semantic analysis; the inspected excerpts show product configuration, localization, and bundled library behavior, with no source-confirmed attack chain.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
7 flagged · loading sourcedist/viewer/prod-DEzUWFeR.jsView file
2patternName = google_api_key
severity = high
line = 2
High
High Secret
Package contains a high-severity secret pattern.
dist/viewer/prod-DEzUWFeR.jsView on unpkg · L22patternName = google_api_key
severity = high
line = 2
High
Secret Pattern
Google API key in dist/viewer/prod-DEzUWFeR.js
dist/viewer/prod-DEzUWFeR.jsView on unpkg · L2dist/viewer/ku-TR-6OUDTVRD-D8yGB2lq.jsView file
7contains invisible/control Unicode U+200C (zero width non-joiner)
یان Alt ڕابگرە و کلیک بکە بۆ زیادکردنی خاڵە نوێیەکان`,placeImage:`کلیک بکە بۆ دانانی وێنەکە، یان کلیک بکە و ڕایبکێشە بۆ ئەوەی قەبارەکەی بە دەستی دابنێیت`,publishLibrary:`کتێبخانەی تایبەت بە خۆت بڵاوبکەرەوە`,bindTextToElement:`بۆ زیادکردنی د
Critical
Trojan Source Unicode
Findings
1 Critical6 High5 Medium6 Low
CriticalTrojan Source Unicodedist/viewer/ku-TR-6OUDTVRD-D8yGB2lq.js
HighHigh Secretdist/viewer/prod-DEzUWFeR.js
HighChild Process
HighCross File Remote Execution Contextdist/server.cjs
HighSemantic Analysis Limiteddist/viewer/c4Diagram-7LVT6UL2-58pCA6H1.js#virtual:string-array:round1
HighKnown Malware Source Similaritydist/viewer/diagram-VX7I27RA-CBejVfwX.js
HighSecret Patterndist/viewer/prod-DEzUWFeR.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/viewer/DocumentPage-CUMc7_Xs.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to ryugi-artifacts@1.4.1.
See all versions of ryugi-artifacts for other recorded verdicts.
- Review the evidence and your use of ryugi-artifacts@1.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.