registry / @accio-ai/ecommerce-cli / 0.4.9
@accio-ai/ecommerce-cli@0.4.9
Local, statically compiled ecommerce automation toolkit
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe postinstall hook initializes the CLI’s local database, and inspected platform manifests contain no install hooks. Runtime diagnostics send a token only to a validated loopback gateway after qualifying command failures; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a business command and the launcher encounters a qualifying failure.
Impact
The local gateway receives the token in an authorization header and a failure event; the event omits command input and output.
Mechanism
Diagnostics require a gateway token and trace context, respect the telemetry-disabled setting, and restrict the destination to loopback before posting to /trace.
AI rationale
The postinstall hook initializes the CLI’s local database, and inspected platform manifests contain no install hooks. Runtime diagnostics send a token only to a validated loopback gateway after qualifying command failures; no concrete attack behavior was found.
Evidence
package.jsonbin/ecomctl.cjslauncher-diagnostics.cjs.lpm-dependency-evidence-84a5b5e8-f8a4-409f-b1f7-caf2d24051e3/0/npm-linux/package.json.lpm-dependency-evidence-84a5b5e8-f8a4-409f-b1f7-caf2d24051e3/1/npm-linux/package.json.lpm-dependency-evidence-84a5b5e8-f8a4-409f-b1f7-caf2d24051e3/2/npm-linux/package.json
Network endpoints1
127.0.0.1:4097/trace
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs postinstall and declares optional platform-specific packages; the inspected platform manifests contain no lifecycle scripts and ship only the CLI binary.
- The launcher invokes diagnostics for launch failures and nonzero exits, while diagnostics skip non-business invocations and honor the telemetry-disabled setting.
- Diagnostics require an environment-provided gateway token and trace context; the gateway URL is restricted to loopback hosts and the request uses the local /trace endpoint.
- The diagnostic event contains failure and correlation metadata with empty input and output fields; the token is sent as Basic authorization to the loopback gateway.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
UrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg14"bin": {
"ecomctl": "bin/ecomctl.cjs"
},
"scripts": {
"postinstall": "node postinstall.cjs"
},
"optionalDependencies": {
"@accio-ai/ecommerce-cli-darwin-arm64
Low
Suspicious Lifecycle Evidence
package.json runs postinstall and declares optional platform-specific packages; the inspected platform manifests contain no lifecycle scripts and ship only the CLI binary.
package.jsonView on unpkg · L14Findings
2 High3 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltabin/ecomctl.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-84a5b5e8-f8a4-409f-b1f7-caf2d24051e3/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-84a5b5e8-f8a4-409f-b1f7-caf2d24051e3/1/npm-linux/package.json
Affected versions and remediation
This report applies to @accio-ai/ecommerce-cli@0.4.9.
See all versions of @accio-ai/ecommerce-cli for other recorded verdicts.
- Review the evidence and your use of @accio-ai/ecommerce-cli@0.4.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.