registry / @accio-ai/ecommerce-cli / 0.4.0
@accio-ai/ecommerce-cli@0.4.0
Local, statically compiled ecommerce automation toolkit
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe automatic setup is consistent with this CLI package, validates the selected platform binary, and includes context and data-path checks. The inspected source establishes no concrete attack behavior, so the static warnings do not support a malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package runs its postinstall hook.
Impact
The CLI may initialize its database under the user's configured or default data location. The inspected source shows no network endpoint or credential transmission.
Mechanism
The hook validates the selected platform binary and invokes it with setup arguments; it skips initialization for privileged and sudo contexts.
AI rationale
The automatic setup is consistent with this CLI package, validates the selected platform binary, and includes context and data-path checks. The inspected source establishes no concrete attack behavior, so the static warnings do not support a malicious verdict.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares a postinstall that runs the package's setup command.
- The setup command selects the platform binary and checks its package identity and SHA-256 against the manifest.
- Initialization is skipped for privileged or sudo contexts, and a configured data path must be absolute and local.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "node postinstall.cjs"
},
"optionalDependencies": {
"@accio-ai/ecommerce-cli-
Low
Suspicious Lifecycle Evidence
package.json declares a postinstall that runs the package's setup command.
package.jsonView on unpkg · L18postinstall.cjsView file
Findings
1 High2 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencepostinstall.cjs
LowAi Review Evidencepostinstall.cjs
LowAi Review Evidencepostinstall.cjs
Affected versions and remediation
This report applies to @accio-ai/ecommerce-cli@0.4.0.
See all versions of @accio-ai/ecommerce-cli for other recorded verdicts.
- Review the evidence and your use of @accio-ai/ecommerce-cli@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.