@pawlogic/dl@0.28.3
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe static hints identify bundled command execution and network behavior, but the inspected manifest makes these user-invoked CLI entrypoints and declares no lifecycle hook. The inspected credential-bearing OAuth request is directed to the configured issuer, and no concrete attack behavior was established.
Decision evidence
public snapshot- The manifest exposes dl.mjs and ilands.mjs as explicit command-line entrypoints and declares no install lifecycle hook.
- The inspected network code uses Actionway and its callback service as endpoints; the credential-bearing request shown is OAuth userinfo at the configured issuer.
- The updater helper is shipped as a file but is not declared as a package lifecycle script.
Source & flagged code
8 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dl.mjsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dl.mjsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @pawlogic/dl@0.28.3.
See all versions of @pawlogic/dl for other recorded verdicts.
- Review the evidence and your use of @pawlogic/dl@0.28.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.