registry / @66rpg/lumimaker / 0.1.50
@66rpg/lumimaker@0.1.50
幻光文游制作器：登录、校验并发布到幻光文游社区；validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe manifest has no npm install lifecycle hook, and prepublishOnly runs build and version checks. Inspected runtime behavior explains the scanner hints as user-invoked CLI operations and package telemetry, with no concrete malicious behavior remaining.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI; project validation runs only when the validate command is selected.
Impact
No unauthorized account change, credential theft, command-output exfiltration, or install-time mutation was established.
Mechanism
Validation invokes the current project's validate script with a recursion guard. Runtime telemetry is package-aligned command event reporting with filtering and opt-out support.
AI rationale
The manifest has no npm install lifecycle hook, and prepublishOnly runs build and version checks. Inspected runtime behavior explains the scanner hints as user-invoked CLI operations and package telemetry, with no concrete malicious behavior remaining.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists no npm install hook; its prepublishOnly script runs the build and version check.
- The indicated runtime locations resolve to project validation metadata, publishing summaries and confirmation prompts, and CLI command choices; they do not establish hidden account actions or agent configuration mutation.
- The CLI runs a project's validate script only when the user invokes validation, and includes a recursion guard. Package analytics sends command event metadata to its vendor endpoint, filters named secret and content fields, and supports opt-out.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @66rpg/lumimaker@0.1.55
matchedIdentity = npm:QDY2cnBnL2x1bWltYWtlcg:0.1.55
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
1import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
Findings
1 Critical5 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.50.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.50 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.