registry / bucket / 0.3.0

bucket@0.3.0

Access any of the popular file storage solutions with a unified API

AI Security Review

scanned 11h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network and credential access is limited to explicitly used cloud-storage backends and their provider endpoints.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Consumer invokes a configured S3, GCS, Azure, B2, R2, or filesystem backend operation.

Impact

Performs requested storage access using supplied environment, configured, or workload credentials.

Mechanism

Storage-provider authentication and file operations.

Rationale

The scanner signals correspond to the package's documented multi-provider storage functionality, activated by consumer operations rather than installation or import. No concrete malicious chain was found.

Evidence

package.jsondist/index.jsdist/chunk-XIEPIE3Y.jsdist/chunk-JVZSKCSS.jsdist/fs/index.js

Network endpoints3

169.254.169.254/latest/meta-data/iam/security-credentials/metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/tokenoauth2.googleapis.com/token

bucket@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code