registry / cdn-img-fetch / 1.0.4

cdn-img-fetch@1.0.4

Fetch and cache CDN images locally for web projects

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No attack was identified. The source implements a caller-invoked HTTPS download to a caller-selected file.

Static reason

No blocking static signals were detected.

Trigger

The caller invokes fetchAndCache with a URL and destination.

Impact

The requested destination is created or overwritten with downloaded content. No confirmed malicious behavior was established.

Mechanism

An HTTPS response is streamed into a local file; no automatic install or import action activates it.

AI rationale

Inspected source shows a small download utility with no lifecycle hooks, hidden destinations, credential collection, or payload execution. Its network and file operations match the exported function's purpose and require caller invocation.

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json selects index.js and declares no lifecycle scripts or dependencies.
The exported download function requests the caller-supplied HTTPS URL and writes the response to the caller-supplied destination.
The entrypoint exports functions without invoking downloads; it contains no credential harvesting, shell execution, or dynamic code loading.

cdn-img-fetch@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code