registry / @66rpg/lumimaker / 0.1.51
@66rpg/lumimaker@0.1.51
幻光文游制作器：登录、校验并发布到幻光文游社区；validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe manifest has no npm install lifecycle hook, and the inspected agent-related code reads package-owned skill target names for project detection. The scanner’s child-process and network signals are consistent with a project CLI, with no concrete attack behavior established.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the lumimaker CLI or invoking its validation workflow.
Impact
No malicious impact was established from the inspected source.
Mechanism
The CLI recognizes project context and can invoke project scripts; the inspected sources do not establish secret harvesting, unrelated data transmission, or agent control-surface mutation.
AI rationale
The manifest has no npm install lifecycle hook, and the inspected agent-related code reads package-owned skill target names for project detection. The scanner’s child-process and network signals are consistent with a project CLI, with no concrete attack behavior established.
Network endpoints6
test-lumimaker.66rpg.com/common/public-info/test.jsonlumimaker.66rpg.com/common/public-info/debug.jsonlumimaker.66rpg.com/common/public-info/release.jsontest-lumi.66rpg.comdebug-lumi.66rpg.comlumi.66rpg.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only packaging and prepublishOnly scripts; it has no preinstall, install, or postinstall hook.
- The flagged dist/index.js location contains project validation helpers and allowed script names, not agent configuration writes.
- dist/index.js reads skill-target directory names from package-owned skill-targets.json to recognize project context.
- The observed network URLs are lumimaker.66rpg.com service endpoints; no unrelated credential recipient was established.
Evidence against
- The CLI imports child_process and can run project scripts as part of its validation workflow.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
1import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
1import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import K from"picocolors";import{spawn as pr}from"node:child_process";import E from"node:fs";import fr from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var $r=new Set(["publish","publish-template","publish-template-data","publish-project"]),Fr=$r,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.51.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.