lightbase-edge@0.1.2
Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).
The one-liner: full-Node SSR on Cloudflare Pages with ZERO Cloudflare Workers. Drop into any codebase — bundles your server, publishes it to your own Pages CDN, registers a sha-pinned auto-deploy manifest with Lightbase, and generates the preflight-free z
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe token forwarding to a caller-configured endpoint presents a conditional credential exposure risk. The inspected source does not establish a hidden or package-controlled recipient, so this supports a warning rather than a block.
Decision evidence
public snapshot- The CLI accepts a caller-provided `LIGHTBASE_URL` and deploy token without restricting the destination.
- Deploy sends that token in an API request to the configured URL; the default command is deploy when credentials are present.
- The manifest describes a Lightbase edge deployment tool and lists only `esbuild` as a dependency.
- The package has no install lifecycle scripts; the network request runs through the CLI command.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
cli.mjsView on unpkg · L134The CLI accepts a caller-provided `LIGHTBASE_URL` and deploy token without restricting the destination.
cli.mjsView on unpkg · L61Findings
Affected versions and remediation
This report applies to lightbase-edge@0.1.2.
See all versions of lightbase-edge for other recorded verdicts.
- Review the evidence and your use of lightbase-edge@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.