registry / @66rpg/lumimaker / 0.1.47
@66rpg/lumimaker@0.1.47
幻光文游制作器：登录、校验并发布到幻光文游社区；validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis release is a user-invoked publisher CLI with no npm install hook and no self-install chain. Agent skill directories are used only after an explicit skill command, and the analytics destination is restricted to the vendor host.
Static reason
One or more suspicious static signals were detected.
Trigger
A person runs the lumimaker bin, including the skill subcommand.
Impact
No unconsented agent-config mutation, credential export, or remote payload execution was identified in this package.
Mechanism
The wrapper prompts, then forwards the chosen command to the vendor helper and allowlisted analytics host. It does not run on npm install.
AI rationale
This release is a user-invoked publisher CLI with no npm install hook and no self-install chain. Agent skill directories are used only after an explicit skill command, and the analytics destination is restricted to the vendor host.
Network endpoints3
fx-it.66rpg.com:8206/salumimaker.66rpg.comlumi.66rpg.com
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes only a user-run lumimaker bin and build, test, prepack, postpack, and prepublishOnly scripts, with no install lifecycle hook.
- dist/index.js lists AGENTS.md with package.json and README.md as template files to check, not as an agent config write.
- The skill path runs only after the user selects the skill command, then prompts for a platform unless flags were already supplied.
- Analytics sends are kept only when the URL is https on fx-it.66rpg.com port 8206 path /sa for the package project.
Evidence against
- skill-targets.json names several editor skill directories, and the skill command can hand work to a separate native helper that is not in this package.
- Optional dependencies are same-version platform packages with different names, not a nested install of this package.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggeddist/index.jsView file
1import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
1import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.47.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.47 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.