registry / @pawlogic/dl / 0.32.0
@pawlogic/dl@0.32.0
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe manifest defines CLI entrypoints without install lifecycle hooks. The flagged telemetry is gated by sandbox-provided settings and tied to self-update reporting; inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A CLI self-update event in a configured sandbox.
Impact
No concrete harmful effect was established from the inspected source.
Mechanism
The bundle posts event fields to the sandbox self-update endpoint using the injected callback URL and token.
AI rationale
The manifest defines CLI entrypoints without install lifecycle hooks. The flagged telemetry is gated by sandbox-provided settings and tied to self-update reporting; inspected source does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes user-run CLI commands and declares no lifecycle hooks.
- The update telemetry requires injected callback and token settings and posts limited self-update event fields to a dedicated endpoint.
- The bundle describes reinstalling this same package as an explicit CLI command.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedTrivialUrlStrings
NoLicense
Source & flagged code
9 flaggeddl.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @pawlogic/dl@0.31.0
matchedIdentity = npm:QHBhd2xvZ2ljL2Rs:0.31.0
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dl.mjsView on unpkg1#!/usr/bin/env node
L2: import e,{readFileSync as t,existsSync as i,mkdirSync as n,writeFileSync as r,chmodSync as o,realpathSync as a,rmSync as s,cpSync as c}from"node:fs";import l,{dirname as d,resolve ...
High
1#!/usr/bin/env node
L2: import e,{readFileSync as t,existsSync as i,mkdirSync as n,writeFileSync as r,chmodSync as o,realpathSync as a,rmSync as s,cpSync as c}from"node:fs";import l,{dirname as d,resolve ...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dl.mjsView on unpkg · L1Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadl.mjs
HighChild Processdl.mjs
HighSame File Env Network Executiondl.mjs
HighCommand Output Exfiltrationdl.mjs
HighSandbox Evasion Gated Capabilitydl.mjs
HighTrigger Reachable Command Output Exfiltrationdl.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdl-npm-update.sh
MediumStructural Risk Force Deep Review
LowEvaldl.mjs
LowWeak Cryptodl.mjs
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @pawlogic/dl@0.32.0.
See all versions of @pawlogic/dl for other recorded verdicts.
- Review the evidence and your use of @pawlogic/dl@0.32.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.