registry / @accio-ai/ecommerce-cli / 0.4.7
@accio-ai/ecommerce-cli@0.4.7
⚠ Under reviewLocal, statically compiled ecommerce automation toolkit
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe inspected JavaScript does not establish malicious behavior, and its diagnostics are gated and loopback-restricted. Because the automatically executed native platform binaries are outside the available source snapshot, their behavior remains unresolved.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs postinstall; invoking the CLI runs the platform-specific binary.
Impact
The native binary’s effects cannot be determined from the inspected source.
Mechanism
The JavaScript resolves and starts the platform binary for setup or user-supplied CLI arguments.
AI rationale
The inspected JavaScript does not establish malicious behavior, and its diagnostics are gated and loopback-restricted. Because the automatically executed native platform binaries are outside the available source snapshot, their behavior remains unresolved.
Evidence
package.jsonbin/ecomctl.cjspostinstall.cjslauncher-diagnostics.cjs
Decision evidence
public snapshotAI called this Manual Review at 86.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest defines a postinstall hook and depends on separate platform-specific packages.
- The launcher resolves and runs a platform-specific native binary; the package snapshot lists JavaScript files but does not include that binary’s source.
- Postinstall automatically invokes the binary’s setup command, with shell execution disabled and a timeout.
- The postinstall initialization skips root and sudo contexts.
- Launcher diagnostics require a qualifying failed business invocation, a gateway token and trace context, and restrict the destination to loopback.
Evidence against
- The inspected JavaScript shows no confirmed malicious action; the native binary’s behavior could not be assessed from this package snapshot.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
UrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg14"bin": {
"ecomctl": "bin/ecomctl.cjs"
},
"scripts": {
"postinstall": "node postinstall.cjs"
},
"optionalDependencies": {
"@accio-ai/ecommerce-cli-darwin-arm64": "0.4.7",
"@accio-ai/ecommerce-cli-darwin-x64": "0.4.7",
"@accio-ai/ecommerce-cli-linux-arm64": "0.4.7",
"@accio-ai/ecommerce-cli-linux-x
Low
Suspicious Lifecycle Evidence
The manifest defines a postinstall hook and depends on separate platform-specific packages.
package.jsonView on unpkg · L14Findings
2 High3 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltabin/ecomctl.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/ecomctl.cjs
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @accio-ai/ecommerce-cli@0.4.7.
See all versions of @accio-ai/ecommerce-cli for other recorded verdicts.
- Review the evidence and your use of @accio-ai/ecommerce-cli@0.4.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.