lightbase-edge@0.1.8

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

The one-liner: full-Node SSR on Cloudflare Pages with ZERO Cloudflare Workers. Drop into any codebase — bundles your server, publishes it to your own Pages CDN, registers a sha-pinned auto-deploy manifest with Lightbase, and generates the preflight-free z

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The package exposes a CLI without install lifecycle scripts. Its inspected credential use and network request support the documented deployment flow, and no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the lightbase-edge CLI deploy command with the required environment settings.

Impact

The configured Lightbase project receives the deployment manifest; no unrelated recipient or malicious effect was established.

Mechanism

The CLI sends the manifest to the configured Lightbase URL and supplies the configured token and project ID.

AI rationale

The package exposes a CLI without install lifecycle scripts. Its inspected credential use and network request support the documented deployment flow, and no concrete attack behavior was found.

Evidence

package.jsoncli.mjs

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines cli.mjs as the executable and main entrypoint; it declares no lifecycle scripts.
cli.mjs reads Lightbase URL, project ID, and token from environment variables.
The deploy command sends the manifest to the configured Lightbase URL, using the configured token for authentication.
Registration is reached through the CLI command selected from process.argv.

Evidence against

No concrete malicious behavior was identified in the inspected entrypoint; its network request is scoped to the configured Lightbase manifest API.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 94.9 KB of source

Source & flagged code

5 flagged

cli.mjsView file

143package = lightbase-edge; repositoryIdentity = lightbase; dependency = esbuild L143: async function bundleEntry(entryPath, outPath, cfg = {}) { L144: const esbuild = await import('esbuild').catch(() => null); L145: if (!esbuild) die('esbuild is required (it ships with this package — reinstall lightbase-edge).');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L143

66const url = (process.env.LIGHTBASE_URL || process.env.LIGHTBASE_BASE_URL || '').replace(/\/+$/, ''); const projectId = process.env.LIGHTBASE_PROJECT_ID || ''; const token = process.env.LIGHTBASE_DEPLOY_TOKEN || process.env.LIGHTB

Low

Ai Review Evidence

cli.mjs reads Lightbase URL, project ID, and token from environment variables.

cli.mjsView on unpkg · L66

1263const resp = await fetch(`${url}/api/v1/projects/${projectId}/edge/apps/${cfg.appId}/manifest`, { method: 'PUT', headers: { "content-type": "application/json", apikey: token, 'x-lightbase-project': projectId, }, body: JSON.s

Low

Ai Review Evidence

The deploy command sends the manifest to the configured Lightbase URL, using the configured token for authentication.

Findings

1 High3 Medium6 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencecli.mjs

Affected versions and remediation

This report applies to lightbase-edge@0.1.8.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 00:19:00.739Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / lightbase-edge / 0.1.8

lightbase-edge@0.1.8

Superseded — use 0.1.15 (the maintained 0.1.1 line with the framework-prep fix).

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The package exposes a CLI without install lifecycle scripts. Its inspected credential use and network request support the documented deployment flow, and no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the lightbase-edge CLI deploy command with the required environment settings.

Impact

The configured Lightbase project receives the deployment manifest; no unrelated recipient or malicious effect was established.

Mechanism

The CLI sends the manifest to the configured Lightbase URL and supplies the configured token and project ID.

AI rationale

The package exposes a CLI without install lifecycle scripts. Its inspected credential use and network request support the documented deployment flow, and no concrete attack behavior was found.

Evidence

package.jsoncli.mjs

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines cli.mjs as the executable and main entrypoint; it declares no lifecycle scripts.
cli.mjs reads Lightbase URL, project ID, and token from environment variables.
The deploy command sends the manifest to the configured Lightbase URL, using the configured token for authentication.
Registration is reached through the CLI command selected from process.argv.

Evidence against

No concrete malicious behavior was identified in the inspected entrypoint; its network request is scoped to the configured Lightbase manifest API.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 94.9 KB of source

Source & flagged code

5 flagged

cli.mjsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli.mjsView on unpkg · L143

Low

Ai Review Evidence

cli.mjs reads Lightbase URL, project ID, and token from environment variables.

cli.mjsView on unpkg · L66

Low

Ai Review Evidence

The deploy command sends the manifest to the configured Lightbase URL, using the configured token for authentication.

Findings

1 High3 Medium6 Low

HighCopied Package Dependency Bridgecli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencecli.mjs

Affected versions and remediation

This report applies to lightbase-edge@0.1.8.

See all versions of lightbase-edge for other recorded verdicts.

Review the evidence and your use of lightbase-edge@0.1.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 00:19:00.739Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.