lightbase-edge@0.1.11
Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).
The one-liner: full-Node SSR on Cloudflare Pages with ZERO Cloudflare Workers. Drop into any codebase — bundles your server, publishes it to your own Pages CDN, registers a sha-pinned auto-deploy manifest with Lightbase, and generates the preflight-free z
AI Security Review
scanned 23d ago · by lpm-firewall-aiSource inspection shows a command-line deployment tool with no install lifecycle hook. Its network requests use an operator-configured API URL and credentials, so the scanner's network and environment signals do not establish malicious behavior.
Decision evidence
public snapshot- The manifest identifies cli.mjs as the package command and main entrypoint; the inspected manifest has no install lifecycle hook.
- The CLI reads its deployment URL, project ID, and token from operator-provided environment variables.
- Deployment sends that token to the manifest API at the configured URL.
- The CLI maps deploy and register to deployment operations; no package-controlled recipient or install-time execution was identified.
Source & flagged code
7 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
cli.mjsView on unpkg · L143The CLI reads its deployment URL, project ID, and token from operator-provided environment variables.
cli.mjsView on unpkg · L66Deployment sends that token to the manifest API at the configured URL.
Findings
Affected versions and remediation
This report applies to lightbase-edge@0.1.11.
See all versions of lightbase-edge for other recorded verdicts.
- Review the evidence and your use of lightbase-edge@0.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.