registry / npmx-connector / 0.16.1

npmx-connector@0.16.1

Local connector for npmx.dev - enables authenticated npm operations from the web UI

AI Security Review

scanned 2h ago · by lpm-firewall-ai

An explicit user-run connector grants the npmx.dev web UI token-gated access to selected authenticated npm CLI operations. No install-time or covert attack surface was established.

Static reason

No blocking static signals were detected.

Trigger

User runs npmx-connector and accepts the confirmation prompt.

Impact

A connected authorized web origin can perform sensitive npm account, organization, package-access, and publishing actions through the user's npm session.

Mechanism

localhost token-gated delegation of allowlisted npm commands

Rationale

The package is not malicious by static source evidence, but it deliberately exposes authenticated npm administration to a web UI and therefore warrants a warning as a dangerous capability.

Evidence

package.jsondist/cli.mjsdist/server-BnX7U6mz.mjs

Network endpoints3

npmx.devregistry.npmjs.org/www.gravatar.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

npmx-connector@0.16.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code