registry / @66rpg/lumimaker / 0.1.37
@66rpg/lumimaker@0.1.37
幻光 lumimaker 平台工具：validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis release is a user-run CLI for Lumimaker template checks and platform commands. The indicated AGENTS.md reference is a required template filename, and package.json does not register an install lifecycle hook.
Static reason
One or more suspicious static signals were detected.
Trigger
No install, import, or automatic agent-config trigger was found.
Impact
No unconsented credential theft, remote payload, or foreign agent control-surface write was established in this package.
Mechanism
The published scripts do not install hooks, and network telemetry is limited to the vendor analytics host after a URL check.
AI rationale
This release is a user-run CLI for Lumimaker template checks and platform commands. The indicated AGENTS.md reference is a required template filename, and package.json does not register an install lifecycle hook.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json scripts are build, test, prepack, postpack, and prepublishOnly only, with no consumer install hook.
- dist/index.js lists AGENTS.md beside package.json and README.md as a required template filename during validation.
- The lumimaker bin entry runs the library only when the user executes the CLI.
- Analytics posts only when the URL stays on https host fx-it.66rpg.com port 8206 path /sa.
Evidence against
- Optional dependencies are platform binaries of the same version, not a nested install of this package.
- The skill command is reached from the interactive CLI and then forwards arguments to the local lumimaker binary.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
1import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
1import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.37.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.