registry / @flui-cloud/vops / 0.1.0

@flui-cloud/vops@0.1.0

Local-first, real-time VPS provider comparison and safe provisioning using provider APIs.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No install-time or import-time attack behavior is established. Remote SSH, cron, backup, and watch API actions are explicit CLI features with source-visible controls.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs a vops host, backup, agent, or watch command.

Impact

Administrative changes may occur only to user-selected hosts or configured watch endpoints.

Mechanism

User-invoked VPS management over SSH and configured cloud API requests.

Rationale

The flagged primitives implement the package’s documented, explicitly invoked VPS-management functions and are not activated during installation or import. No credential harvesting, stealth persistence, remote payload execution, or unconsented control-surface mutation was confirmed.

Evidence

package.jsonbin/runlib/ui/app.jslib/ui/index.jslib/lib/cloud-client.jslib/host-ops/vops-host-keys.service.jslib/commands/host/key/install-ops.jslib/backup/backup-render.jslib/agent/vops-agent.service.js

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with false-positive risk.

@flui-cloud/vops@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code