@accio-ai/ecommerce-cli@0.4.3
Local, statically compiled ecommerce automation toolkit
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe inspected JavaScript shows an automatic install-time launch of a native executable, but its implementation is unavailable in this package snapshot. The wrapper suggests local database setup and does not establish a concrete attack, so warn pending review of the executable behavior.
Decision evidence
public snapshot- The manifest runs a postinstall hook and declares platform-specific native binaries as optional dependencies.
- The hook verifies the selected binary against a checksum, then automatically invokes it during installation.
- The native binary implementation is absent from this package snapshot, so its install-time behavior cannot be resolved from the inspected source.
- The wrapper invokes a fixed setup argument vector with shell execution disabled and a bounded timeout.
- The JavaScript launcher passes CLI arguments to the platform binary; the inspected wrapper contains no network or credential transfer.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe manifest runs a postinstall hook and declares platform-specific native binaries as optional dependencies.
package.jsonView on unpkg · L17Findings
Affected versions and remediation
This report applies to @accio-ai/ecommerce-cli@0.4.3.
See all versions of @accio-ai/ecommerce-cli for other recorded verdicts.
- Review the evidence and your use of @accio-ai/ecommerce-cli@0.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.