@pawlogic/dl@0.16.0
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest declares command-line entrypoints but no install lifecycle hook, and the inspected network paths use configured account or sandbox services. The helper’s update reporting is conditional on environment-provided callback and token values and concerns update events, so the scanner signals do not establish malicious behavior.
Decision evidence
public snapshot- The manifest exposes two command-line entrypoints and declares no install lifecycle hook.
- The download CLI routes sandbox requests through the configured callback service and uses an account token with the configured account issuer for login.
- The account CLI uses its configured sandbox service or sends the login token to the configured issuer’s user-information endpoint.
- The update helper reports only when both callback URL and proxy token are present; its event contains update outcomes and operational metadata.
- The helper installs the named package into its user-local prefix using a validated distribution tag.
Source & flagged code
7 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dl.mjsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dl.mjsView on unpkg · L1Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
Affected versions and remediation
This report applies to @pawlogic/dl@0.16.0.
See all versions of @pawlogic/dl for other recorded verdicts.
- Review the evidence and your use of @pawlogic/dl@0.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.