registry / @66rpg/lumimaker / 0.1.59
@66rpg/lumimaker@0.1.59
幻光文游制作器：登录、校验并发布到幻光文游社区；validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe flagged execution and network signals resolve to CLI behavior and vendor-aligned analytics with filtering and opt-out controls. No install-time attack or command-output exfiltration path was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running CLI commands, unless analytics are disabled by environment settings or execution is in CI or a test context.
Impact
The inspected flow discloses limited usage metadata, including a device identifier and account UID; no command output or credentials were identified in the event fields.
Mechanism
The runtime constructs events from filtered, type-limited metadata and posts them to a validated vendor endpoint.
AI rationale
The flagged execution and network signals resolve to CLI behavior and vendor-aligned analytics with filtering and opt-out controls. No install-time attack or command-output exfiltration path was established.
Network endpoints1
fx-it.66rpg.com:8206/sa?project=huanguang
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hook; its prepublishOnly script runs build and version checks.
- The CLI entrypoint invokes the package runtime when the user runs the command.
- The analytics endpoint is fixed to the package vendor, and endpoint overrides must pass the same host and path checks.
- Analytics can be disabled through environment settings; CI and test contexts also disable it.
- Analytics properties exclude credential, content, error, path, and command argument fields; values are type-limited and strings are capped.
- Events contain command and outcome metadata, and the sender posts the constructed analytics event to the validated endpoint.
- The inspected dependencies expose prompt, color, and schema-validation code; their manifests identify ordinary package entrypoints.
Evidence against
- Runtime analytics is enabled by default outside CI unless the user opts out, and may include a device identifier and account UID.
- Scanner hints flag command execution and networking, but the inspected transfer path sends filtered analytics metadata rather than command output.
Behavioral surface
Source & flagged code
7 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @66rpg/lumimaker@0.1.56
matchedIdentity = npm:QDY2cnBnL2x1bWltYWtlcg:0.1.56
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1import K from"picocolors";import{spawn as Or}from"node:child_process";import C from"node:fs";import Fr from"node:os";import U from"node:path";var vn={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var ci=new Set(["publish","publish-template","publish-template-data","publish-project"]),mi=ci,Rn="LUMIMAKER_PUBLISH_CONFIRMED";function dt(e,t=process.env){e...
High
1import K from"picocolors";import{spawn as Or}from"node:child_process";import C from"node:fs";import Fr from"node:os";import U from"node:path";var vn={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var ci=new Set(["publish","publish-template","publish-template-data","publish-project"]),mi=ci,Rn="LUMIMAKER_PUBLISH_CONFIRMED";function dt(e,t=process.env){e...
Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskill/lumimaker-game-cover-maker/scripts/generate_image.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.59.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.