@webtwizz/cloud@0.5.0
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install-time hook; its prepublishOnly script is for building and checking the package. Reviewed network, credential, and database paths use caller or environment supplied service configuration and are invoked through package functionality, with no unrelated collection or automatic exfiltration identified.
Decision evidence
public snapshot- The only lifecycle script is prepublishOnly, which runs build, typecheck, and tests.
- Auth requests use the explicitly configured WEBTWIZZ_AUTH_URL or options.url.
- Auth and storage credentials are read for configured service clients, and the storage endpoint comes from WEBTWIZZ_STORAGE_ENDPOINT.
- Database access is created through an explicit createDb call using the supplied URL or DATABASE_URL.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
AI_GUIDE.mdView on unpkgThe only lifecycle script is prepublishOnly, which runs build, typecheck, and tests.
package.jsonView on unpkg · L58Findings
Affected versions and remediation
This report applies to @webtwizz/cloud@0.5.0.
See all versions of @webtwizz/cloud for other recorded verdicts.
- Review the evidence and your use of @webtwizz/cloud@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.