files.com@2.0.11
Files.com SDK for JavaScript
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package presents as the Files.com JavaScript SDK, has no lifecycle scripts, and its CLI launcher only locates and forwards to a local binary. The API key is caller-configured and sent to the SDK’s Files.com endpoint.
Static reason
No blocking static signals were detected.
Trigger
SDK network requests occur when the caller uses the API; the CLI wrapper runs when explicitly invoked.
Impact
No unauthorized collection, unrelated network contact, or other malicious behavior was identified.
Mechanism
API requests use the configured Files.com endpoint and caller-provided credentials. The shell wrapper forwards arguments to a configured or locally available CLI binary.
AI rationale
The package presents as the Files.com JavaScript SDK, has no lifecycle scripts, and its CLI launcher only locates and forwards to a local binary. The API key is caller-configured and sent to the SDK’s Files.com endpoint.
Network endpoints1
app.files.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies files.com as the Files.com JavaScript SDK and declares no install or lifecycle scripts.
- The AI CLI shell wrapper only forwards arguments to a configured or locally available files-cli binary; it does not download or execute remote code.
- The SDK defaults to https://app.files.com and leaves its API key unset until the caller supplies one.
- The API client requires a configured API key or session ID and sends the key as the Files.com API header.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
Source & flagged code
5 flaggedbuild.shView file
•path = build.sh
kind = build_helper
sizeBytes = 277
magicHex = [redacted]
Medium
lib/models/AutomationLog.jsView file
•path = lib/models/AutomationLog.js
kind = oversized_source_file
sizeBytes = 4631391
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
lib/models/AutomationLog.jsView on unpkgbin/files-cli-aiView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
Findings
1 Critical1 High5 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedbin/files-cli-ai
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbuild.sh
MediumOversized Source Filelib/models/AutomationLog.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to files.com@2.0.11.
See all versions of files.com for other recorded verdicts.
- Review the evidence and your use of files.com@2.0.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.