lightbase-edge@0.1.6

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

The one-liner: full-Node SSR on Cloudflare Pages with ZERO Cloudflare Workers. Drop into any codebase — bundles your server, publishes it to your own Pages CDN, registers a sha-pinned auto-deploy manifest with Lightbase, and generates the preflight-free z

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The manifest contains no install lifecycle hook, and the inspected CLI behavior is consistent with user-invoked deployment to the configured Lightbase service. Scanner signals for network access and environment variables correspond to that functionality; no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A user or build pipeline invokes a CLI command such as deploy or register.

Impact

No malicious or unauthorized effect was established from the inspected source.

Mechanism

The CLI reads Lightbase configuration and sends the deployment token with a manifest request to the configured Lightbase URL.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares only esbuild as a runtime dependency and has no lifecycle script.
cli.mjs selects commands from the caller's command-line arguments.
The manifest request sends the deployment token to the configured Lightbase API URL for the selected project and app.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 90.3 KB of source

Source & flagged code

4 flagged

cli.mjsView file

143package = lightbase-edge; repositoryIdentity = lightbase; dependency = esbuild L143: async function bundleEntry(entryPath, outPath, cfg = {}) { L144: const esbuild = await import('esbuild').catch(() => null); L145: if (!esbuild) die('esbuild is required (it ships with this package — reinstall lightbase-edge).');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L143

1760const cmd = process.argv[2] || 'deploy'; // BismiLLAH (0.1.6 — always-produce CI): `deploy`/`optimize` NEVER exit early — // without complete credentials they assemble the Pages output and skip only // the manifest PUT, so a CI "outpu

Low

Ai Review Evidence

cli.mjs selects commands from the caller's command-line arguments.

cli.mjsView on unpkg · L1760

1216const resp = await fetch(`${url}/api/v1/projects/${projectId}/edge/apps/${cfg.appId}/manifest`, { method: 'PUT', headers: { "content-type": "application/json", apikey: token, 'x-lightbase-project': projectId, }, body: JSON.stringify(manifest), }); const body = await resp.json().catc

Low

Findings

1 High3 Medium5 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencecli.mjs

Affected versions and remediation

This report applies to lightbase-edge@0.1.6.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 10:01:33.972Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / lightbase-edge / 0.1.6

lightbase-edge@0.1.6

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A user or build pipeline invokes a CLI command such as deploy or register.

Impact

No malicious or unauthorized effect was established from the inspected source.

Mechanism

The CLI reads Lightbase configuration and sends the deployment token with a manifest request to the configured Lightbase URL.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares only esbuild as a runtime dependency and has no lifecycle script.
cli.mjs selects commands from the caller's command-line arguments.
The manifest request sends the deployment token to the configured Lightbase API URL for the selected project and app.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 90.3 KB of source

Source & flagged code

4 flagged

cli.mjsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L143

Low

Ai Review Evidence

cli.mjs selects commands from the caller's command-line arguments.

cli.mjsView on unpkg · L1760

Low

Findings

1 High3 Medium5 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencecli.mjs

Affected versions and remediation

This report applies to lightbase-edge@0.1.6.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 10:01:33.972Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.