bailian-cli-runtime
Runtime framework for bailian-cli (createCli, registry, args, output, pipeline). See https://www.npmjs.com/package/bailian-cli for usage.
This report shows the evidence for bailian-cli-runtime@2.8.0. 0 of 34 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package exports a runtime module without install hooks. Its network and subprocess behavior supports CLI updates and allowlisted Command Packs, with package scripts disabled and credential access gated.
Decision evidence
public snapshot- The manifest has no install, preinstall, or postinstall lifecycle hook; its package entry is the dist runtime module.
- The update check fetches the package’s latest version from registry.npmjs.org and runs in the CLI command flow.
- Command Pack names must be on the caller-provided supported list, and npm installs use --ignore-scripts.
- Command Pack API-key access is guarded by an explicit credentialAccess permission and an apiKey auth declaration.
- The CLI behavior is exposed through createCli with an explicit run method; the package does not declare a bin entry.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.mjsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
Affected versions and remediation
This report applies to bailian-cli-runtime@2.8.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of bailian-cli-runtime@2.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.