registry / @66rpg/lumimaker / 0.1.34
@66rpg/lumimaker@0.1.34
幻光 lumimaker 平台工具：validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no install lifecycle hook or concrete malicious behavior. The indicated agent integration location is a validation requirement for AGENTS.md, not configuration mutation.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the package CLI or its validation functionality.
Impact
No unconsented install-time action, credential export, or agent-control-surface mutation was established.
Mechanism
The validator reads project paths and reports missing required files. Analytics configuration restricts its destination to a fixed package-aligned HTTPS endpoint.
AI rationale
Static inspection found no install lifecycle hook or concrete malicious behavior. The indicated agent integration location is a validation requirement for AGENTS.md, not configuration mutation.
Network endpoints1
fx-it.66rpg.com:8206/sa?project=huanguang
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata contains build, test, pack, and publish scripts, but no registry install lifecycle hook.
- The indicated agent-related location only names AGENTS.md as a required project file.
- The surrounding validator checks required files and records missing-file errors; it does not modify agent configuration.
- The bundled analytics destination accepts only one fixed HTTPS host, port, path, and project query value.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
1import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
1import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.34.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.