@accio-ai/ecommerce-cli@0.4.2
⚠ Under reviewLocal, statically compiled ecommerce automation toolkit
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe inspected source confirms automatic native binary execution during installation, but the binary's behavior cannot be assessed from this snapshot. This unresolved execution boundary supports manual review, not a confirmed malicious verdict.
Decision evidence
public snapshot- package.json runs postinstall.cjs automatically and declares six exact-version platform packages.
- postinstall.cjs automatically initializes by invoking the selected platform binary with setup arguments.
- The platform binary is absent from this snapshot, so its behavior and any effects of setup could not be inspected.
- The launcher also delegates user-supplied commands to the platform binary.
- Postinstall verifies the selected binary against a package-provided checksum before use.
- Initialization skips privileged and sudo identities and invokes the binary without a shell. These guards do not reveal the binary's behavior.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json runs postinstall.cjs automatically and declares six exact-version platform packages.
package.jsonView on unpkg · L17Findings
Affected versions and remediation
This report applies to @accio-ai/ecommerce-cli@0.4.2.
See all versions of @accio-ai/ecommerce-cli for other recorded verdicts.
- Review the evidence and your use of @accio-ai/ecommerce-cli@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.