@buildinternet/uploads@0.3.0: Clean npm security report (Allow)

Loading npm security reports…

@buildinternet/uploads@0.3.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

3 flagged

dist/commands/install.jsView file

•Published source reference

Low

Ai Review Evidence

`dist/commands/install.js` explicitly runs `npx -y skills add buildinternet/uploads --skill uploads-cli` on `uploads install`.

dist/commands/install.jsView on unpkg

•Published source reference

Low

Ai Review Evidence

`dist/commands/install.js` explicitly invokes `claude mcp add` to register `https://agents.uploads.sh/mcp` with a bearer-token header.

dist/commands/install.jsView on unpkg

package.jsonView file

Lines 40-66json

40 },

41 "peerDependenciesMeta": {

42 "files-sdk": {

43 "optional": true

44 }

45 },

46 "devDependencies": {

47 "@types/node": "^26.1.0",

48 "ai": "^6.0.0",

49 "files-sdk": "^2.1.0",

50 "typescript": "^6.0.3",

51 "vitest": "^4.1.10"

52 },

53 "publishConfig": {

54 "access": "public",

55 "provenance": true

56 },

57 "dependencies": {

58 "sharp": "^0.35.3"

59 },

60 "scripts": {

Low

Suspicious Lifecycle Evidence

`bin/uploads.js` executes the CLI only when the user invokes the `uploads` binary; `package.json` has no lifecycle hooks.

package.jsonView on unpkg · L60

61 "test": "vitest run",

62 "typecheck": "tsc --noEmit && tsc --noEmit -p test",

63 "build": "tsc",

64 "pack:check": "node ./scripts/check-pack.mjs"

65 }

66}

Source & flagged code

3 flagged · loading source

dist/commands/install.jsView file

•Published source reference

Low

Ai Review Evidence

`dist/commands/install.js` explicitly runs `npx -y skills add buildinternet/uploads --skill uploads-cli` on `uploads install`.

dist/commands/install.jsView on unpkg

•Published source reference

Low

Ai Review Evidence

`dist/commands/install.js` explicitly invokes `claude mcp add` to register `https://agents.uploads.sh/mcp` with a bearer-token header.

dist/commands/install.jsView on unpkg

package.jsonView file

•Published source reference

Low

Suspicious Lifecycle Evidence

`bin/uploads.js` executes the CLI only when the user invokes the `uploads` binary; `package.json` has no lifecycle hooks.

package.jsonView on unpkg

@buildinternet/uploads@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code