@pawlogic/dl@0.16.2
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected credential transfers are part of authenticated CLI requests to configured gateways or product defaults, and the package has no install lifecycle hook. The updater telemetry is conditional on sandbox callback settings and limited to update diagnostics, so the scanner signals do not establish an attack.
Decision evidence
public snapshot- The manifest declares two CLI entrypoints and no install lifecycle hook.
- The dl CLI uses a saved login token with its configured gateway, or requires both sandbox callback settings for sandbox access.
- The dl request helpers send that token to the selected API route for the requested operation.
- The ilands CLI loads or refreshes a saved session, selects its configured gateway or product default, and sends the token with API requests.
- Updater reporting requires a configured callback URL and proxy token; it sends update status, sandbox context, and at most 200 bytes of npm error output.
- The updater helper does transmit user and sandbox identifiers and a capped npm error tail to the configured callback, but this is conditional updater telemetry.
Source & flagged code
7 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dl.mjsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dl.mjsView on unpkg · L1Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
Affected versions and remediation
This report applies to @pawlogic/dl@0.16.2.
See all versions of @pawlogic/dl for other recorded verdicts.
- Review the evidence and your use of @pawlogic/dl@0.16.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.