registry / npmx-connector / 0.16.0

npmx-connector@0.16.0

Local connector for npmx.dev - enables authenticated npm operations from the web UI

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The user-invoked CLI exposes authenticated, allowlisted npm administration actions through a token-protected localhost server after consent.

Static reason

No blocking static signals were detected.

Trigger

User runs npmx-connector and accepts the prompt.

Impact

Authorized users may intentionally administer npm organizations, teams, package access, owners, or publish a placeholder package.

Mechanism

Token-gated localhost bridge to validated npm CLI operations.

Rationale

Source inspection shows an explicit-user CLI connector rather than install-time or covert behavior. Its powerful npm actions are constrained to an allowlist, parameter validation, localhost binding, and a displayed random token.

Evidence

package.jsondist/cli.mjsdist/server-C1JDm1nD.mjs

Network endpoints3

npmx.dev/registry.npmjs.org/www.gravatar.com/avatar/

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

npmx-connector@0.16.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code