electron-orbit@1.1.0
Electron-style runtime discovery and launch planning toolkit with optional native bootstrap installation
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe automatic hook creates data-bearing artifacts containing host, account, and path details, which is an unresolved local data-handling risk. The source does not establish external disclosure or an active attack, so a warning is appropriate.
Decision evidence
public snapshot- The package runs install.js automatically through its postinstall hook.
- The installer embeds the machine host name and account name in JSON used to build a platform-named artifact.
- The installer writes that generated artifact to disk and also writes a marker under the working directory or temporary directory containing local path details.
- The inspected installer and runtime source show no network transfer of the collected details.
- The runtime checks whether the artifact exists but builds launch plans using the Node executable; no artifact execution was found.
Source & flagged code
9 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package runs install.js automatically through its postinstall hook.
package.jsonView on unpkg · L53Findings
Affected versions and remediation
This report applies to electron-orbit@1.1.0.
See all versions of electron-orbit for other recorded verdicts.
- Review the evidence and your use of electron-orbit@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.