registry / blitzframes / 0.0.3

blitzframes@0.0.3

Faster Remotion Lambda renders on your own AWS account.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

An explicitly deployed Lambda function downloads and executes JavaScript supplied by the BlitzFrames relay. No automatic package-install attack was identified.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the CLI deployment flow and confirms deployment.

Impact

The relay operator can change code executed in the user's deployed Lambda function after deployment.

Mechanism

The deployment writes a NODE_OPTIONS import loader that fetches relay content and imports it as JavaScript.

AI rationale

The behavior is user-invoked and package-aligned, but it installs an opaque remote code loader into a customer Lambda. Static source cannot establish what future relay responses execute.

Evidence

src/install.mjssrc/index.mjssrc/guided.mjs

Network endpoints1

blitzframes.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package has no install lifecycle hook; it exposes a CLI and library entry point.

blitzframes@0.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code