registry  /  @feedmob/feedmob-pixel-cli  /  0.2.1

@feedmob/feedmob-pixel-cli@0.2.1

FeedMob Pixel Dashboard data query CLI

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network use is package-aligned Dashboard API access plus an npm registry update check, both at CLI runtime.

Static reason
One or more suspicious static signals were detected.
Trigger
User invokes fpc commands after install
Impact
Authenticated dashboard data can be queried or exported as requested by the user; no exfiltration or persistence found.
Mechanism
Read-only API query CLI with optional user config write/export output
Rationale
Static inspection shows a product-aligned FeedMob Pixel Dashboard CLI: install-time code only prints instructions, while runtime commands read local token config and call the configured Dashboard API. The token/config and CSV file writes are explicit user-invoked behavior, with no credential harvesting, hidden execution, persistence, or foreign agent-surface mutation.
Evidence
package.jsonscripts/postinstall.cjsdist/cli.jsdist/client.jsdist/config.jsdist/updateCheck.jsdist/commands/init.jsdist/commands/records.js~/.fpc/config.jsonuser-supplied --out path
Network endpoints2
feedmob-pixel-dashboard.feedmob.com/registry.npmjs.org

Decision evidence

public snapshot
AI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json postinstall only runs scripts/postinstall.cjs
    • scripts/postinstall.cjs only prints setup guidance to stdout
    • dist/cli.js only builds commander CLI and performs runtime update check
    • dist/client.js sends authenticated GET/HEAD requests to configured Dashboard API
    • dist/config.js reads env/config and writes ~/.fpc/config.json only via user-invoked init
    • No child_process, eval, native loading, persistence, or AI-agent control-surface writes found
    Behavioral surface
    Source
    ChildProcessEnvironmentVarsFilesystem
    Supply chain
    HighEntropyStringsUrlStrings
    Manifest
    NoLicense
    scanned 18 file(s), 48.7 KB of source, external domains: feedmob-pixel-dashboard.feedmob.com, github.com, registry.npmjs.org

    Source & flagged code

    2 flagged · loading source
    package.jsonView file
    •scripts.postinstall = node ./scripts/postinstall.cjs
    High
    Install Time Lifecycle Scripts

    Package defines install-time lifecycle scripts.

    package.jsonView on unpkg
    •scripts.postinstall = node ./scripts/postinstall.cjs
    Medium
    Ambiguous Install Lifecycle Script

    Install-time lifecycle script is not statically allowlisted and needs review.

    package.jsonView on unpkg

    Findings

    1 High2 Medium6 Low
    HighInstall Time Lifecycle Scriptspackage.json
    MediumAmbiguous Install Lifecycle Scriptpackage.json
    MediumEnvironment Vars
    LowNon Install Lifecycle Scripts
    LowScripts Present
    LowFilesystem
    LowHigh Entropy Strings
    LowUrl Strings
    LowNo License