registry / @66rpg/lumimaker / 0.1.52
@66rpg/lumimaker@0.1.52
幻光文游制作器：登录、校验并发布到幻光文游社区；validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest provides a CLI entrypoint and no npm install lifecycle hook. The inspected validation and conditional analytics paths do not establish credential theft, command-output exfiltration, or another concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the lumimaker CLI; analytics sends only when enabled by its configuration.
Impact
No concrete attack effect was established from the inspected source.
Mechanism
The CLI runs project validation and may send analytics event data to a configured endpoint after filtering properties.
AI rationale
The manifest provides a CLI entrypoint and no npm install lifecycle hook. The inspected validation and conditional analytics paths do not establish credential theft, command-output exfiltration, or another concrete attack.
Evidence
package.jsonbin/lumimaker.jsdist/index.js
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI entrypoint through bin/lumimaker.js, which imports and runs dist/index.js.
- The indicated dist/index.js location is project validation logic that checks expected project directories, files, and scripts.
- Analytics is disabled when configuration opts out or supplies no accepted endpoint.
- Analytics builds event properties from filtered values and sends them only when enabled.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
1import K from"picocolors";import{spawn as fr}from"node:child_process";import P from"node:fs";import _r from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Ur=new Set(["publish","publish-template","publish-template-data","publish-project"]),Vr=Ur,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
1import K from"picocolors";import{spawn as fr}from"node:child_process";import P from"node:fs";import _r from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Ur=new Set(["publish","publish-template","publish-template-data","publish-project"]),Vr=Ur,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import K from"picocolors";import{spawn as fr}from"node:child_process";import P from"node:fs";import _r from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Ur=new Set(["publish","publish-template","publish-template-data","publish-project"]),Vr=Ur,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.52.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.