a public repository, read by nittim
codex-team/editor.js security audit
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
A block-style editor with clean JSON output
TypeScript · 32k stars · last push November 1, 2026
codex-team/editor.js is a block-style editor written in TypeScript that produces clean JSON output. The repository contains TypeScript code organized across 280 files that nittim scanned completely.
Nittim found evidence of vulnerable runtime dependencies in codex-team/editor.js. The scan identified 31 vulnerable runtime dependencies. Among the vulnerable packages are @babel/traverse with GHSA-67hx-6x53-jw92, brace-expansion with GHSA-3jxr-9vmj-r5cp and GHSA-6j4f-fj2g-mc7p, braces with GHSA-grv7-fg5c-xmjg, browserslist with GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx, cross-spawn with GHSA-3xgq-45jj-v275, extract-zip with GHSA-7pqw-9j4j-h8q3 and GHSA-jmr9-qjv8-65gv, flatted with GHSA-25h7-pfq9-p65f and GHSA-rf6f-7fwh-wjgh, form-data with GHSA-fjxv-7rqg-78g4 and GHSA-hmw2-7cc7-3qxx, js-yaml with GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m and GHSA-5p4m-2wfm-xmqj, lodash with GHSA-r5fr-rj
Written from nittim's own scan on November 6, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 280 of 280 eligible files. Commit cfbf1da. 2026-11-06.
What the scanners found
- Committed secrets on production paths
- 0
- Vulnerable runtime dependencies
- 31
@babel/traverse (GHSA-67hx-6x53-jw92), brace-expansion (GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p), braces (GHSA-grv7-fg5c-xmjg), browserslist (GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx), cross-spawn (GHSA-3xgq-45jj-v275), extract-zip (GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv), flatted (GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh), form-data (GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx), js-yaml (GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj), lodash (GHSA-r5fr-rjxr-66jc), minimatch (GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj), picomatch (GHSA-c2c7-rcm5-vvqj), postcss (GHSA-6g55-p6wh-862q)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in codex-team/editor.js?
- nittim read 280 of 280 eligible files in codex-team/editor.js. The reading ran on November 6, 2026. It was taken at commit cfbf1da.
- Did nittim find committed secrets or vulnerable dependencies in codex-team/editor.js?
- The rule-based scan found 0 committed secrets and 31 vulnerable dependencies in codex-team/editor.js. Affected: @babel/traverse (GHSA-67hx-6x53-jw92), brace-expansion (GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p), braces (GHSA-grv7-fg5c-xmjg), browserslist (GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx), cross-spawn (GHSA-3xgq-45jj-v275), extract-zip (GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv), flatted (GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh), form-data (GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx), js-yaml (GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj), lodash (GHSA-r5fr-rjxr-66jc), minimatch (GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj), picomatch (GHSA-c2c7-rcm5-vvqj), postcss (GHSA-6g55-p6wh-862q).
- Is codex-team/editor.js production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
More TypeScript repositories →
Add the badge to your README
[](https://nittim.com/library/codex-team/editor.js)