files.com@1.2.743
Files.com SDK for JavaScript
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe SDK and CLI behavior reviewed matches the package’s stated purpose, with no automatic malicious activity identified. However, the optional build.sh removes the caller’s npm and Yarn configuration files, an unexpected destructive side effect that warrants a warning.
Decision evidence
public snapshot- The package exposes an SDK entry point and a CLI launcher, with no lifecycle hook declared in the manifest.
- The SDK’s API client builds requests from the configured Files.com base URL; its default is https://app.files.com.
- The CLI launcher forwards arguments to a locally found files-cli binary.
- The shipped build.sh deletes ~/.npmrc and ~/.yarnrc before running npm install and the build. Invoking this helper can remove the user’s package-manager configuration.
- The build helper is separate from the declared npm scripts and is not an install or import hook.
Source & flagged code
6 flaggedPackage contains source files above the normal full-analysis size ceiling.
lib/models/AutomationLog.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/files-cli-aiView on unpkgTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgThe package exposes an SDK entry point and a CLI launcher, with no lifecycle hook declared in the manifest.
package.jsonView on unpkg · L20The SDK’s API client builds requests from the configured Files.com base URL; its default is https://app.files.com.
src/Files.jsView on unpkg · L5Findings
Affected versions and remediation
This report applies to files.com@1.2.743.
See all versions of files.com for other recorded verdicts.
- Review the evidence and your use of files.com@1.2.743 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.