registry / @66rpg/lumimaker / 0.1.53
@66rpg/lumimaker@0.1.53
幻光文游制作器：登录、校验并发布到幻光文游社区；validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 24d ago · by lpm-firewall-aiSource inspection found no install-time execution or malicious attack behavior. The scanner’s agent-configuration hint points to a project validation filename list, while the flagged network behavior is constrained analytics reporting.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI can record command-result events when analytics is enabled.
Impact
The inspected behavior reports CLI usage metadata and UID; no credential theft or agent configuration mutation was established.
Mechanism
The package submits event metadata over HTTPS to its fixed analytics endpoint; its URL validator rejects other hosts, ports, paths, and project identifiers.
AI rationale
Source inspection found no install-time execution or malicious attack behavior. The scanner’s agent-configuration hint points to a project validation filename list, while the flagged network behavior is constrained analytics reporting.
Evidence
package.jsonbin/lumimaker.jsdist/index.js
Network endpoints1
fx-it.66rpg.com:8206/sa?project=huanguang
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines build and packaging scripts but no preinstall, install, or postinstall hook; its executable is the CLI entrypoint.
- The indicated AGENTS.md occurrence is in a list of project files that validation checks for; this excerpt shows no agent configuration write.
- Analytics accepts only HTTPS requests to the fixed fx-it.66rpg.com host, port, path, and project identifier.
- Analytics sends CLI event metadata such as command outcome, platform, login status, and UID; the inspected payload does not include an authentication token.
- Analytics transmission is disabled when its effective enabled setting is false; event tracking checks that setting before queueing events.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
1import K from"picocolors";import{spawn as fr}from"node:child_process";import P from"node:fs";import _r from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Ur=new Set(["publish","publish-template","publish-template-data","publish-project"]),Vr=Ur,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
1import K from"picocolors";import{spawn as fr}from"node:child_process";import P from"node:fs";import _r from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Ur=new Set(["publish","publish-template","publish-template-data","publish-project"]),Vr=Ur,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import K from"picocolors";import{spawn as fr}from"node:child_process";import P from"node:fs";import _r from"node:os";import V from"node:path";var an={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Ur=new Set(["publish","publish-template","publish-template-data","publish-project"]),Vr=Ur,hn="LUMIMAKER_PUBLISH_CONFIRMED";function it(e,t=process.env){e...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.53.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.53 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.