@pawlogic/dl@0.24.2
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected updater operates within its local package prefix. Its operational reports go to an environment-configured callback and include identifiers, but the inspected source does not establish an attack or unauthorized disclosure.
Decision evidence
public snapshot- package.json exposes `dl` and `ilands` as CLI binaries and declares no lifecycle scripts.
- The `dl.mjs` update-event sender returns when the callback URL or token is absent.
- `ilands.mjs` dispatches commands from user-supplied arguments.
- The updater installs the named package into `/home/user/.local` when a tag is available and npm is present.
- Updater reports require a configured callback URL and token; the report contains update metadata and project, user, prompt, and tool-call identifiers.
Source & flagged code
7 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dl.mjsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dl.mjsView on unpkg · L1Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
Affected versions and remediation
This report applies to @pawlogic/dl@0.24.2.
See all versions of @pawlogic/dl for other recorded verdicts.
- Review the evidence and your use of @pawlogic/dl@0.24.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.