Loading npm security reports…
Netlify config module
LPM treats this as warn-only first-party agent extension lifecycle risk. A guarded extension lifecycle can automatically enable Netlify extensions based on dependencies in the target project's package manifest. It sends the supplied Netlify token to an extension host returned by fetched metadata; no install-time execution occurs.
`lib/utils/extensions/auto-install-extensions.js` conditionally auto-installs extensions when a feature flag, site/account IDs, token, and build directory are supplied.
lib/utils/extensions/auto-install-extensions.jsView on unpkgIt reads the project's `package.json`, fetches extension metadata, and POSTs the Netlify token to each metadata-supplied extension host.
package.jsonView on unpkg`lib/api/site_info.js` also fetches extension installation metadata and forwards a build-bot token only behind an explicit feature flag.
lib/api/site_info.jsView on unpkg`lib/utils/extensions/auto-install-extensions.js` conditionally auto-installs extensions when a feature flag, site/account IDs, token, and build directory are supplied.
lib/utils/extensions/auto-install-extensions.jsView on unpkgIt reads the project's `package.json`, fetches extension metadata, and POSTs the Netlify token to each metadata-supplied extension host.
package.jsonView on unpkg`lib/api/site_info.js` also fetches extension installation metadata and forwards a build-bot token only behind an explicit feature flag.
lib/api/site_info.jsView on unpkg