lightbase-edge@0.1.10
Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).
The one-liner: full-Node SSR on Cloudflare Pages with ZERO Cloudflare Workers. Drop into any codebase — bundles your server, publishes it to your own Pages CDN, registers a sha-pinned auto-deploy manifest with Lightbase, and generates the preflight-free z
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the reviewed network activity belongs to an explicit deployment CLI flow using configured Lightbase credentials. The scanner's network and environment-variable signals are consistent with that functionality and do not establish malicious behavior.
Decision evidence
public snapshot- The package exposes cli.mjs as its command-line executable and main entrypoint.
- The CLI defines explicit user-invoked commands, including init and deploy.
- Credentials are read from Lightbase environment variables and sent to the corresponding project manifest endpoint.
- The manifest request is performed by the deploy command; package.json defines no install lifecycle hook.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
cli.mjsView on unpkg · L143The CLI defines explicit user-invoked commands, including init and deploy.
cli.mjsView on unpkg · L1905Credentials are read from Lightbase environment variables and sent to the corresponding project manifest endpoint.
Findings
Affected versions and remediation
This report applies to lightbase-edge@0.1.10.
See all versions of lightbase-edge for other recorded verdicts.
- Review the evidence and your use of lightbase-edge@0.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.