runlot@0.1.0-rc.161
⚠ Under reviewrunlot CLI — deploy apps and manage PostgreSQL
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe package declares and reaches a required registry dependency whose source could not be inspected. This leaves its behavior unresolved, so manual review is appropriate; the unresolved source alone is not evidence of an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A CLI operation opens the PGlite database.
Impact
The dependency's behavior remains unresolved, so the package cannot be cleared as benign from this review.
Mechanism
The bundle dynamically imports @electric-sql/pglite; its dependency source was unavailable for inspection.
AI rationale
The package declares and reaches a required registry dependency whose source could not be inspected. This leaves its behavior unresolved, so manual review is appropriate; the unresolved source alone is not evidence of an attack.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest lists @electric-sql/pglite@0.4.3 as a dependency, and the CLI bundle imports it when opening its PGlite database.
- The manifest lists build, test, and typecheck scripts; it shows no install lifecycle script.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/index.jsView file
43// ../../packages/api/src/index.ts
L44: function base64urlJson(v) {
L45: const bytes = new TextEncoder().encode(JSON.stringify(v));
...
L50: function gitQuery(ref, path) {
L51: const q = new URLSearchParams();
L52: if (ref !== "") q.set("ref", ref);
...
L109: async request(method, path, init) {
L110: const res = await fetch(new URL(path, this.opts.baseUrl), {
L111: ...init,
...
L1144: * hostname (the original request went there), and the server derives the org
L1145: * and project names from it. Doing `location.replace` with the `redirect` that
L1146: * comes back is the caller's job.
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L433553});
L3554: readFromStdout(stdout);
L3555: afterClose(null);
...
L3563: let worker = new worker_threads2.Worker(__filename, {
L3564: workerData: { workerPort, defaultWD, esbuildVersion: "0.24.2" },
L3565: transferList: [workerPort],
L3566: // From node's documentation: https://nodejs.org/api/worker_threads.html
L3567: //
L3568: // Take care when launching worker threads from preload scripts (scripts loaded
L3569: // and run using the `-r` command line flag). Unless the `execArgv` option is
L3570: // explicitly set, new Worker threads automatically inherit the command line flags
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L3553Findings
4 Critical5 High7 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumSecret Patterndist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
Affected versions and remediation
This report applies to runlot@0.1.0-rc.161.
See all versions of runlot for other recorded verdicts.
- Review the evidence and your use of runlot@0.1.0-rc.161 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.