registry / blitzframes / 0.0.1

blitzframes@0.0.1

Faster Remotion Lambda renders on your own AWS account.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

An explicit deployment installs a runtime loader into an AWS Lambda function. No install-time attack was identified.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the BlitzFrames deployment flow.

Impact

The relay operator can change code executed in the user's deployed Lambda function.

Mechanism

The deployed function receives NODE_OPTIONS that fetches and dynamically imports relay-provided JavaScript.

AI rationale

The source establishes a real remote runtime-code loading path, but not a demonstrated malicious payload or covert install-time attack. This warrants a warning for dangerous capability rather than a publication block.

Evidence

src/install.mjssrc/index.mjs

Network endpoints1

blitzframes.com/api/relay.mjs/<token>

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package exposes a CLI and library entrypoint without an automatic lifecycle hook.

blitzframes@0.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code