@vectoree/cli@0.1.18
Official Vectoree CLI — login, link, database, storage, Model Gateway, and Tool Hub
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is a CLI whose API requests and key creation are tied to explicit commands and the configured Vectoree service. The scanner's command-execution and outbound-request signals resolve to device identification and ordinary CLI API functionality, with no automatic exfiltration behavior found.
Decision evidence
public snapshot- The manifest defines build, development, typecheck, test, and lint scripts; it has no install lifecycle hook.
- The CLI sends API keys or login tokens through its API request helper to the configured API origin.
- The hostname, OS device ID, and current directory are included when the explicit `link` command creates a project API key.
- The executable parses CLI commands at startup; the inspected code does not perform the flagged requests automatically on import.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgSource combines command execution, command-output handling, and outbound requests; review data flow before blocking.
Findings
Affected versions and remediation
This report applies to @vectoree/cli@0.1.18.
See all versions of @vectoree/cli for other recorded verdicts.
- Review the evidence and your use of @vectoree/cli@0.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.