registry / @tachybase/module-cloud-component / 1.6.55
@tachybase/module-cloud-component@1.6.55
Cloud component
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package manifest has no lifecycle scripts, and its server code fetches and runs remote libraries only when those libraries are configured and enabled. This matches the package's cloud-component purpose; the scanner's download and VM alerts are consistent with that feature, and no unrelated collection or automatic host-data exfiltration was found.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The application starts with enabled cloud-library records; remote fetching occurs only for records configured with a remote source, URL, and code type.
Impact
Configured cloud-library code runs within the application as part of the package's stated feature.
Mechanism
The plugin fetches configured library code, compiles it, and runs server code in a VM context.
AI rationale
The package manifest has no lifecycle scripts, and its server code fetches and runs remote libraries only when those libraries are configured and enabled. This matches the package's cloud-component purpose; the scanner's download and VM alerts are consistent with that feature, and no unrelated collection or automatic host-data exfiltration was found.
Network endpoints2
raw.githubusercontent.comConfigured codeUrl host
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no lifecycle scripts, and its main entry point exports the server plugin.
- Cloud libraries default to local code; remote fetching requires a library configured with codeSource="remote", a URL, and a code type.
- The plugin loads enabled cloud libraries after application startup, consistent with its cloud-component purpose.
- Remote GitHub code is fetched from raw.githubusercontent.com and compiled server code runs in a VM context as part of the library-loading feature.
Evidence against
- When enabled cloud libraries are configured, the plugin loads and executes their server code automatically after application startup.
- Remote library configuration can include authentication credentials that are passed to the configured fetch URL. No source evidence showed those credentials being sent to an unrelated collector.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47dist/client/index.jsView file
•path = dist/client/index.js
kind = oversized_source_file
sizeBytes = 8254994
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/client/index.jsView on unpkgdist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
Findings
1 Critical2 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/node_modules/@babel/core/lib/index.js
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.55.
See all versions of @tachybase/module-cloud-component for other recorded verdicts.
- Review the evidence and your use of @tachybase/module-cloud-component@1.6.55 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.