registry  /  @stage5/lumine  /  0.2.6

@stage5/lumine@0.2.6

Command line tools for launching Lumine builds on Twinkle.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package is a Twinkle/Lumine CLI with explicit commands for login, pulling/saving projects, assets, thumbnails, and SDK calls. The main unresolved firewall concern is user-invoked creation of first-party AGENTS.md/CLAUDE.md guidance in pulled workspaces, not install-time hijacking.

Static reason
No blocking static signals were detected.
Trigger
Running lumine pull/reference/workspace or related CLI commands after install
Impact
Can write Twinkle project files, .twinkle metadata, assets manifest, login token file, and AGENTS.md/CLAUDE.md in selected workspaces under user control
Mechanism
user-invoked first-party workspace and agent-instruction setup
Rationale
Source inspection shows no install-time execution, exfiltration, stealth persistence, destructive behavior, or remote payload execution. Because it performs explicit user-command agent instruction setup in workspaces, classify as warn rather than block.
Evidence
package.jsonbin/lumine.jslib/commands.jslib/auth.jslib/api.jslib/http.jslib/workspace.jslib/constants.jslib/assets.jslib/sdk.jslib/thumbnail.js~/.twinkle/lumine-cli-auth.json<workspace>/AGENTS.md<workspace>/CLAUDE.md<workspace>/.twinkle/lumine-project.json<workspace>/.twinkle/assets.json<workspace>/TWINKLE_BUILD_SDK.md
Network endpoints3
api.twinkle.networkwww.twin-kle.comregistry.npmjs.org

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • lib/workspace.js writes AGENTS.md and CLAUDE.md into pulled workspaces when absent or marker-owned.
  • lib/constants.js embeds Lumine agent instructions that steer Codex/Claude workflow for Twinkle projects.
  • lib/auth.js stores scoped login tokens in ~/.twinkle/lumine-cli-auth.json after explicit login.
  • lib/api.js and lib/http.js send authenticated requests to Twinkle API endpoints.
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle scripts.
  • bin/lumine.js only invokes CLI main; behavior is user-command driven, not import-time.
  • Network hosts are package-aligned defaults: api.twinkle.network, www.twin-kle.com, registry.npmjs.org.
  • No eval/vm/Function, obfuscated payload, native binary loading, or remote code execution found.
  • Workspace file writes validate paths stay inside the selected project directory.
  • AGENTS.md/CLAUDE.md writes avoid clobbering customized files by requiring the Lumine marker.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 11 file(s), 167 KB of source, external domains: api.twinkle.network, registry.npmjs.org, www.twin-kle.com

Source & flagged code

4 flagged · loading source
lib/workspace.jsView file
•Published source reference
Medium
Ai Review Evidence

lib/workspace.js writes AGENTS.md and CLAUDE.md into pulled workspaces when absent or marker-owned.

lib/workspace.jsView on unpkg
lib/constants.jsView file
•Published source reference
Medium
Ai Review Evidence

lib/constants.js embeds Lumine agent instructions that steer Codex/Claude workflow for Twinkle projects.

lib/constants.jsView on unpkg
lib/auth.jsView file
•Published source reference
Medium
Ai Review Evidence

lib/auth.js stores scoped login tokens in ~/.twinkle/lumine-cli-auth.json after explicit login.

lib/auth.jsView on unpkg
lib/api.jsView file
•Published source reference
Medium
Ai Review Evidence

lib/api.js and lib/http.js send authenticated requests to Twinkle API endpoints.

lib/api.jsView on unpkg

Findings

6 Medium5 Low
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/workspace.js
MediumAi Review Evidencelib/constants.js
MediumAi Review Evidencelib/auth.js
MediumAi Review Evidencelib/api.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License