bailian-cli-runtime@2.1.0
Runtime framework for bailian-cli (createCli, registry, args, output, pipeline). See https://www.npmjs.com/package/bailian-cli for usage.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAutomatic same-product updating followed by an opaque agent-skill command is a guarded extension-lifecycle risk. It is not an npm lifecycle action and no concrete malicious behavior was found.
Decision evidence
public snapshot- The manifest exposes a module entrypoint and contains no npm install lifecycle script.
- The runtime update path runs a global npm update for bailian-cli.
- After an update, the runtime invokes a command to update an agent skill.
- Version checks use the fixed npm registry host.
- The behavior is triggered by CLI command execution, not package installation.
- No inspected source shows credential collection, data exfiltration, or a confirmed agent-config destination.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.mjsFindings
Affected versions and remediation
This report applies to bailian-cli-runtime@2.1.0.
See all versions of bailian-cli-runtime for other recorded verdicts.
- Review the evidence and your use of bailian-cli-runtime@2.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.