registry / @bodhiapp/bodhi-js-core / 0.0.41

@bodhiapp/bodhi-js-core@0.0.41

Core types and interfaces for Bodhi Browser SDK

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The explicit CLI mutates a browser-extension project manifest and installs embedded setup-modal HTML. No install-time execution or covert exfiltration was found.

Static reason

No blocking static signals were detected.

Trigger

User runs the bodhi-js-core CLI.

Impact

Can alter the host extension's exposed resources and sandbox configuration.

Mechanism

Writes extension UI files and broad manifest resource/sandbox entries.

Rationale

The package is not malicious, but its user-invoked CLI has meaningful extension-manifest mutation capability. Downgrade to a warning under the explicit setup/extension lifecycle policy.

Evidence

package.jsondist/cli/setup-modal.jsdist/bodhi-core.esm.jsmanifest.jsonsrc/bodhi-js-core/setup-modal.htmlsrc/bodhi-js-core/setup-modal-v2.htmlsrc/bodhi-js-core/version.json

Network endpoints3

localhost:1135cloud.getbodhi.appbodhi-ext${path}

Decision evidence

public snapshot

@bodhiapp/bodhi-js-core@0.0.41

AI Security Review

Decision evidence

Source & flagged code

Findings