registry / lightbase-edge / 0.1.12
lightbase-edge@0.1.12
Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).
The Lightbase Edge deploy tool: full-Node SSR for any Node codebase (Astro, Nuxt, Next, custom servers) served through the Lightbase edge gateway with a static CDN front. Zero edge functions, zero provisioning, zero rewrites — bundles your server, publish
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package exposes a deployment CLI without its own install lifecycle hook. Inspected CLI network and file operations serve its deployment and build functions, while the esbuild lifecycle hook installs its platform binary.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes a lightbase-edge command; esbuild’s installer runs when that dependency is installed.
Impact
No unrelated credential transfer, unrequested account action, or other confirmed attack effect was identified.
Mechanism
The CLI builds or deploys project output and registers a manifest at the configured Lightbase URL. esbuild installs or starts its platform binary for bundling.
AI rationale
The package exposes a deployment CLI without its own install lifecycle hook. Inspected CLI network and file operations serve its deployment and build functions, while the esbuild lifecycle hook installs its platform binary.
Evidence
package.jsoncli.mjs.lpm-dependency-evidence-65de1ef2-1692-4a05-adaa-d5abd2cc8738/0/npm-linux/package.json.lpm-dependency-evidence-65de1ef2-1692-4a05-adaa-d5abd2cc8738/0/npm-linux/install.js.lpm-dependency-evidence-65de1ef2-1692-4a05-adaa-d5abd2cc8738/0/npm-linux/lib/main.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes cli.mjs as the package entry point and declares esbuild as a dependency.
- The CLI selects named commands at runtime; its init command writes project configuration and build scripts when invoked.
- The CLI sends the deployment token to the configured Lightbase URL for manifest registration.
- esbuild’s postinstall runs its installer, which obtains the platform binary from the npm registry if needed.
- esbuild’s runtime starts its bundled service process for build operations.
Evidence against
- The package manifest has no lifecycle script that runs the CLI during installation.
- The inspected network and file operations support the stated deployment and bundling functions; no unrelated recipient or attack behavior was identified.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
7 flaggedcli.mjsView file
146package = lightbase-edge; repositoryIdentity = lightbase; dependency = esbuild
L146: // (monorepo symlink — npm installs a REAL symlink, not a copy), ESM
L147: // import('esbuild') resolves from the package's REAL path, where the host
L148: // project's esbuild is invisible → "esbuild is required" on every deploy.
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
cli.mjsView on unpkg · L1462022// ---- main ------------------------------------------------------------------------
const cmd = process.argv[2] || 'deploy';
// BismiLLAH (0.1.6 — always-produce CI): `deploy`/`optimize` NEVER exit early —
// without complete credentials they assemble the Pages output and skip only
// the manifest PUT, so a CI "output directory" always exists and the live
// manifest keeps serving (pinned-bundle preservation keeps the old origin
// fetchable). Only register/status/logs still skip gracefully. A lightbase.edge.json
// `enforced: true` flips back to strict fail-closed for strict pipelines.
Low
Ai Review Evidence
The CLI selects named commands at runtime; its init command writes project configuration and build scripts when invoked.
cli.mjsView on unpkg · L2022109function cmdInit() {
const fw = detectFramework();
const cfg = {
appId: process.env.LIGHTBASE_EDGE_APP_ID || basename(CWD).toLowerCase().replace(/[^a-z0-9-]+/g, '-').slice(0, 62) || 'app',
framework: fw,
entry: fw === 'astro' ? 'dist/server/entry.mjs' : fw === 'next' ? '.next/standalone/server.js' : 'server.js',
staticOut: fw === 'astro' ? 'dist' : fw === 'next' ? 'dist_lb' : 'dist',
...(fw === 'next' ? { hybrid: true } : {}),
assetPrefixes: fw === 'astro' ? ['/_astro/', '/fonts/', '/images/', '/f
Findings
1 High3 Medium8 Low
HighCopied Package Dependency Bridgecli.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencecli.mjs
LowAi Review Evidencecli.mjs
LowAi Review Evidencecli.mjs
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-65de1ef2-1692-4a05-adaa-d5abd2cc8738/0/npm-linux/package.json
Affected versions and remediation
This report applies to lightbase-edge@0.1.12.
See all versions of lightbase-edge for other recorded verdicts.
- Review the evidence and your use of lightbase-edge@0.1.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.