@artilingo/artiframe-cli@3.0.1
ArtiFrame — Zero-dependency native PHP framework with a powerful multilingual CLI. Scaffold projects, generate views, APIs and classes instantly.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe automatic postinstall dependency installation creates a concrete but package-scoped install-time risk because dependency lifecycle code may run. No source evidence inspected establishes a malicious chain, so this is suspicious rather than malicious.
Decision evidence
public snapshot- package.json runs scripts/postinstall.js automatically after installation.
- The postinstall hook runs npm install --production in each bundled studio directory, triggering dependency resolution during package installation.
- The database studio declares runtime dependencies that this install step will resolve.
- The dependency installations target the package's bundled studio directories; inspected source did not establish credential collection, exfiltration, or remote payload execution.
- The CLI entrypoint handles version checks or delegates arguments to PHP.
Source & flagged code
5 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
db-studio/preload.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @artilingo/artiframe-cli@3.0.1.
See all versions of @artilingo/artiframe-cli for other recorded verdicts.
- Review the evidence and your use of @artilingo/artiframe-cli@3.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.