lightbase-edge@0.1.5
Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).
The one-liner: full-Node SSR on Cloudflare Pages with ZERO Cloudflare Workers. Drop into any codebase — bundles your server, publishes it to your own Pages CDN, registers a sha-pinned auto-deploy manifest with Lightbase, and generates the preflight-free z
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection shows a user-invoked deployment CLI with no install lifecycle hook. Its credential use is an API-key request to the operator-configured Lightbase endpoint, consistent with the package’s stated deployment purpose; the scanner hints do not establish malicious behavior.
Decision evidence
public snapshot- package.json exposes cli.mjs as a command-line tool and runtime entrypoint.
- Deployment requires Lightbase configuration and credentials from environment variables.
- The deploy command sends its token to the configured Lightbase API URL to register a manifest.
- Network activity is gated by the selected CLI command; no install lifecycle hook is declared.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
cli.mjsView on unpkg · L136Deployment requires Lightbase configuration and credentials from environment variables.
cli.mjsView on unpkg · L63The deploy command sends its token to the configured Lightbase API URL to register a manifest.
Findings
Affected versions and remediation
This report applies to lightbase-edge@0.1.5.
See all versions of lightbase-edge for other recorded verdicts.
- Review the evidence and your use of lightbase-edge@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.