registry / @tachybase/module-cloud-component / 1.6.41
@tachybase/module-cloud-component@1.6.41
Cloud component
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package has no install lifecycle scripts or runtime dependencies, and the flagged dynamic execution is tied to enabled cloud libraries. Remote fetching is conditional on library configuration and serves the package’s stated cloud component functionality; no unrelated attack behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
Application startup processes enabled cloud library records; remote fetching requires a record configured with a remote source, URL, and code type.
Impact
Configured library code can affect the application, but the reviewed behavior is part of the package’s cloud component functionality; no unrelated collection or attack behavior was found.
Mechanism
The service fetches configured remote library code, caches it in the application database, compiles it, and executes server libraries in a VM context.
AI rationale
The package has no install lifecycle scripts or runtime dependencies, and the flagged dynamic execution is tied to enabled cloud libraries. Remote fetching is conditional on library configuration and serves the package’s stated cloud component functionality; no unrelated attack behavior was identified.
Evidence
Application database cloudLibraries.codeCacheApplication runtime app.modules
Network endpoints4
User-configured code URLsgithub.comraw.githubusercontent.comgitlab.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to dist/server/index.js and declares no runtime dependencies.
- Remote library fetching is conditional on a library being configured with remote source, URL, and type; fetched content is cached.
- Server library compilation and loading run after application startup as part of the cloud library feature.
- Library code runs in a VM context with selected globals disabled, consistent with the package’s configurable cloud library feature.
Evidence against
- Enabled remote libraries can cause configured code to be fetched and executed at application startup.
- The VM sandbox exposes a context-specific require function, so its isolation is not a complete security boundary.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47dist/client/index.jsView file
•path = dist/client/index.js
kind = oversized_source_file
sizeBytes = 8254994
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/client/index.jsView on unpkgdist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
Findings
1 Critical1 High4 Medium6 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
LowSuspicious Dependency Evidencepackage.json
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.41.
See all versions of @tachybase/module-cloud-component for other recorded verdicts.
- Review the evidence and your use of @tachybase/module-cloud-component@1.6.41 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.