bailian-cli-runtime@1.20.0
Runtime framework for bailian-cli (createCli, registry, args, output, pipeline). See https://www.npmjs.com/package/bailian-cli for usage.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe reviewed execution and network behavior is consistent with the CLI's own update function, and the manifest declares no install lifecycle hook. The scanner's execution and network matches do not establish exfiltration or another attack in the inspected source.
Decision evidence
public snapshot- The manifest exports the runtime bundle and lists only build, development, test, and check scripts; no install lifecycle hook is declared.
- The CLI checks for updates after a command completes and uses its own package identity for the update path.
- The update runs npm with inherited output and checks the installed package version; the command-pack path validator enforces configured command prefixes.
- A qualifying version check can trigger a global CLI update automatically.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.mjsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L1Findings
Affected versions and remediation
This report applies to bailian-cli-runtime@1.20.0.
See all versions of bailian-cli-runtime for other recorded verdicts.
- Review the evidence and your use of bailian-cli-runtime@1.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.