registry / @tachybase/module-cloud-component / 1.6.64
@tachybase/module-cloud-component@1.6.64
Cloud component
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package has no lifecycle scripts, and the flagged VM execution is limited to enabled cloud libraries loaded by the host application. This behavior matches the package's cloud-component purpose; the client bundle's download/run hint did not establish shell execution.
Static reason
No blocking static signals were detected.
Trigger
The host application starts, then the service processes enabled cloud-library records.
Impact
Expected execution of configured cloud components; no package-directed secret collection, unrelated network contact, or destructive action was identified.
Mechanism
It compiles configured library code and runs server libraries in a VM context.
AI rationale
The package has no lifecycle scripts, and the flagged VM execution is limited to enabled cloud libraries loaded by the host application. This behavior matches the package's cloud-component purpose; the client bundle's download/run hint did not establish shell execution.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no lifecycle scripts.
- The service compiles only cloud libraries marked enabled.
- The service registers compilation and loading after the host application starts.
- Configured server library code runs in a VM context as part of the cloud-library feature.
Evidence against
- No package install hook or automatic network contact is present in the manifest.
- The reviewed execution path is for configured cloud libraries, matching the package's stated cloud-component purpose.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
dist/client/index.js
Source & flagged code
5 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47dist/client/index.jsView file
•path = dist/client/index.js
kind = oversized_source_file
sizeBytes = 8254994
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/client/index.jsView on unpkgdist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
Findings
1 Critical1 High4 Medium6 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.64.
See all versions of @tachybase/module-cloud-component for other recorded verdicts.
- Review the evidence and your use of @tachybase/module-cloud-component@1.6.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.