lightbase-edge
The Lightbase Edge deploy tool: full-Node SSR for any Node codebase (Astro, Nuxt, Next, custom servers) served through the Lightbase edge gateway with a static CDN front. Zero edge functions, zero provisioning, zero rewrites — bundles your server, publish
This report shows the evidence for lightbase-edge@0.1.17. 2 of 15 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 34m ago · by lpm-firewall-aiThe package's main entry performs a deploy by default when imported, using ambient Lightbase credentials to update an app manifest. Although the destination is the configured service and deployment matches the CLI's purpose, automatic use of the user's token on import meets the stated malicious automatic-action rule.
Decision evidence
public snapshot- package.json exposes cli.mjs as both the package main and executable.
- cli.mjs defaults to the deploy command and invokes the selected command at module top level, so importing the main entry runs deploy.
- The deploy command reads LIGHTBASE_DEPLOY_TOKEN or LIGHTBASE_API_KEY from the environment.
- Deploy sends a PUT with that token to the configured Lightbase URL to register or update the app manifest.
- The package is described as a Lightbase deployment CLI, and deployment is its stated purpose.
- The token is sent to the configured Lightbase service URL, not to an unrelated collector.
- Deployment requires Lightbase configuration and credentials to make the authenticated request.
Source & flagged code
6 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
cli.mjsView on unpkg · L146cli.mjs defaults to the deploy command and invokes the selected command at module top level, so importing the main entry runs deploy.
cli.mjsView on unpkg · L2114cli.mjs defaults to the deploy command and invokes the selected command at module top level, so importing the main entry runs deploy.
Findings
Affected versions and remediation
This report applies to lightbase-edge@0.1.17.
The versions list below shows the verdict for each recorded version.
- Avoid installing lightbase-edge@0.1.17. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.