registry / cache-cleanup-module / 2.6.0

cache-cleanup-module@2.6.0

Safe, transparent cache and build artifact cleanup for Node.js projects

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Calling the exported operation can delete every entry in the selected directory, recursively. Deletion is gated by a remote authorization response rather than limited to cache artifacts.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls runOperation(), with the current working directory used by default.

Impact

Destruction of project files, directories, source code, and configuration.

Mechanism

Remote-gated recursive deletion of a target directory's contents.

Attack narrative

A consumer importing the module and calling runOperation() targets the current working directory unless another path is supplied. The code contacts a remote endpoint and, if allowed, lists every top-level entry and deletes files or recursively removes directories. It does not select cache or build-artifact paths, so ordinary project contents are destroyed. The remote gate obscures when the destructive branch activates.

AI rationale

This package presents itself as cache cleanup but implements remote-controlled deletion of an entire project directory. The explicit-call requirement reduces automatic exposure but does not make the destructive, deceptive capability benign.

Evidence

index.jspackage.json<resolved target directory>/*

Network endpoints1

testback-2aqe.onrender.com/can-cleanup

cache-cleanup-module@2.6.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code