lightbase-edge@0.1.7

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

The one-liner: full-Node SSR on Cloudflare Pages with ZERO Cloudflare Workers. Drop into any codebase — bundles your server, publishes it to your own Pages CDN, registers a sha-pinned auto-deploy manifest with Lightbase, and generates the preflight-free z

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The manifest declares no lifecycle hook, and the executable is presented as a user-run CLI. Its observed credential use is tied to manifest registration at the configured Lightbase URL, with no evidence of an attack surface beyond the package's deployment function.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the CLI deploy command, or invokes init to add a postbuild deployment hook.

Impact

The configured service receives the deployment manifest and token as required for registration; no unrelated exfiltration or destructive behavior was established.

Mechanism

The CLI assembles deployment files and sends the manifest with the supplied token to the configured service URL.

AI rationale

Evidence

package.jsonlightbase.edge.json

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes cli.mjs as a user-run command and has no lifecycle scripts; its only declared dependency is esbuild.
cli.mjs init writes deployment configuration and wires a postbuild deploy when the user invokes init.
The CLI defaults to deploy; it uploads a manifest and API token to the configured Lightbase URL during deployment.

Evidence against

The inspected network request is a manifest registration PUT to the configured service URL, not an unrelated recipient.
No concrete malicious behavior was identified in the inspected source.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 94.4 KB of source

Source & flagged code

5 flagged

cli.mjsView file

143package = lightbase-edge; repositoryIdentity = lightbase; dependency = esbuild L143: async function bundleEntry(entryPath, outPath, cfg = {}) { L144: const esbuild = await import('esbuild').catch(() => null); L145: if (!esbuild) die('esbuild is required (it ships with this package — reinstall lightbase-edge).');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L143

109function cmdInit() { const fw = detectFramework(); const cfg = { appId: process.env.LIGHTBASE_EDGE_APP_ID || basename(CWD).toLowerCase().replace(/[^a-z0-9-]+/g, '-').slice(0, 62) || 'app', framework: fw, entry: fw === 'astro' ? 'dist/server/entry.mjs' : fw === 'next' ? '.next/standalone/server.js' : 'server.js', staticOut: fw === 'astro' ? 'dist' :

Low

Ai Review Evidence

cli.mjs init writes deployment configuration and wires a postbuild deploy when the user invokes init.

cli.mjsView on unpkg · L109

1821// ---- main ------------------------------------------------------------------------ const cmd = process.argv[2] || 'deploy'; // BismiLLAH (0.1.6 — always-produce CI): `deploy`/`optimize` NEVER exit early — // without complete credentials they assemble the Pages output and skip only // the man

Findings

1 High3 Medium6 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencecli.mjs

Affected versions and remediation

This report applies to lightbase-edge@0.1.7.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 23:34:25.821Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / lightbase-edge / 0.1.7

lightbase-edge@0.1.7

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the CLI deploy command, or invokes init to add a postbuild deployment hook.

Impact

The configured service receives the deployment manifest and token as required for registration; no unrelated exfiltration or destructive behavior was established.

Mechanism

The CLI assembles deployment files and sends the manifest with the supplied token to the configured service URL.

AI rationale

Evidence

package.jsonlightbase.edge.json

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes cli.mjs as a user-run command and has no lifecycle scripts; its only declared dependency is esbuild.
cli.mjs init writes deployment configuration and wires a postbuild deploy when the user invokes init.
The CLI defaults to deploy; it uploads a manifest and API token to the configured Lightbase URL during deployment.

Evidence against

The inspected network request is a manifest registration PUT to the configured service URL, not an unrelated recipient.
No concrete malicious behavior was identified in the inspected source.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 94.4 KB of source

Source & flagged code

5 flagged

cli.mjsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L143

Low

Ai Review Evidence

cli.mjs init writes deployment configuration and wires a postbuild deploy when the user invokes init.

cli.mjsView on unpkg · L109

Findings

1 High3 Medium6 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencecli.mjs

Affected versions and remediation

This report applies to lightbase-edge@0.1.7.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 23:34:25.821Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.