lightbase-edge@0.1.14

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

The Lightbase Edge deploy tool: full-Node SSR for any Node codebase (Astro, Nuxt, Next, custom servers) served through the Lightbase edge gateway with a static CDN front. Zero edge functions, zero provisioning, zero rewrites — bundles your server, publish

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The package’s main entry is also a CLI that immediately defaults to deploy, so importing it can publish project artifacts without an explicit deploy request. The observed network request targets the configured Lightbase service and matches the package’s stated purpose, so this warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.

Trigger

Import through the package main entry without a command argument.

Impact

An import may publish the current project without an explicit deploy request.

Mechanism

The entry defaults to deploy and immediately dispatches the selected command, which can build artifacts and register a manifest using configured credentials.

AI rationale

Evidence

package.jsoncli.mjslightbase.edge.jsondist

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

package.json sets cli.mjs as both the executable and main entry; cli.mjs defaults a missing command to deploy and dispatches it at top level.
The deploy flow sends the manifest and configured API token to the configured LIGHTBASE_URL host.

Evidence against

The package metadata has no lifecycle scripts.
The package describes a deployment CLI, and its manifest request matches that purpose.
The esbuild bridge resolves the host project's dependency before falling back to the package dependency.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 105 KB of source

Source & flagged code

4 flagged

cli.mjsView file

146package = lightbase-edge; repositoryIdentity = lightbase; dependency = esbuild L146: // (monorepo symlink — npm installs a REAL symlink, not a copy), ESM L147: // import('esbuild') resolves from the package's REAL path, where the host L148: // project's esbuild is invisible → "esbuild is required" on every deploy.

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L146

2025const cmd = process.argv[2] || 'deploy'; // BismiLLAH (0.1.6 — always-produce CI): `deploy`/`optimize` NEVER exit early — // without complete credentials they

Medium

Ai Review Evidence

package.json sets cli.mjs as both the executable and main entry; cli.mjs defaults a missing command to deploy and dispatches it at top level.

cli.mjsView on unpkg · L2025

1416const resp = await fetch(`${url}/api/v1/projects/${projectId}/edge/apps/${cfg.appId}/manifest`, { method: 'PUT', headers: { "content-type": "application/json", apikey

Medium

Ai Review Evidence

The deploy flow sends the manifest and configured API token to the configured LIGHTBASE_URL host.

Findings

1 High6 Medium2 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

MediumAi Review Evidencecli.mjs

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to lightbase-edge@0.1.14.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 09:48:20.834Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / lightbase-edge / 0.1.14

lightbase-edge@0.1.14

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

Import through the package main entry without a command argument.

Impact

An import may publish the current project without an explicit deploy request.

Mechanism

The entry defaults to deploy and immediately dispatches the selected command, which can build artifacts and register a manifest using configured credentials.

AI rationale

Evidence

package.jsoncli.mjslightbase.edge.jsondist

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

package.json sets cli.mjs as both the executable and main entry; cli.mjs defaults a missing command to deploy and dispatches it at top level.
The deploy flow sends the manifest and configured API token to the configured LIGHTBASE_URL host.

Evidence against

The package metadata has no lifecycle scripts.
The package describes a deployment CLI, and its manifest request matches that purpose.
The esbuild bridge resolves the host project's dependency before falling back to the package dependency.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 105 KB of source

Source & flagged code

4 flagged

cli.mjsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L146

2025const cmd = process.argv[2] || 'deploy'; // BismiLLAH (0.1.6 — always-produce CI): `deploy`/`optimize` NEVER exit early — // without complete credentials they

Medium

Ai Review Evidence

package.json sets cli.mjs as both the executable and main entry; cli.mjs defaults a missing command to deploy and dispatches it at top level.

cli.mjsView on unpkg · L2025

1416const resp = await fetch(`${url}/api/v1/projects/${projectId}/edge/apps/${cfg.appId}/manifest`, { method: 'PUT', headers: { "content-type": "application/json", apikey

Medium

Ai Review Evidence

The deploy flow sends the manifest and configured API token to the configured LIGHTBASE_URL host.

Findings

1 High6 Medium2 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

MediumAi Review Evidencecli.mjs

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to lightbase-edge@0.1.14.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 09:48:20.834Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.