@accio-ai/ecommerce-cli@0.3.2
Local, statically compiled ecommerce automation toolkit
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected source implements a transparent platform CLI launcher and guarded installation setup without concrete malicious behavior. Missing optional dependency binaries limit coverage but do not establish an attack.
Decision evidence
public snapshot- package.json exposes the CLI wrapper and an installation hook, with platform-specific optional dependencies rather than a runtime self-dependency.
- The installation hook verifies the platform binary's SHA-256 checksum before execution.
- Installation invokes the fixed setup command with shell execution disabled and a timeout.
- Default initialization skips privileged accounts and rejects unsuitable home paths.
- The CLI forwards caller arguments to the resolved platform binary with inherited environment and terminal streams.
- Platform binaries reside in separate optional packages and are absent from this snapshot; their internal behavior was not inspected.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json exposes the CLI wrapper and an installation hook, with platform-specific optional dependencies rather than a runtime self-dependency.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to @accio-ai/ecommerce-cli@0.3.2.
See all versions of @accio-ai/ecommerce-cli for other recorded verdicts.
- Review the evidence and your use of @accio-ai/ecommerce-cli@0.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.