Security & audit

LPM CLI separates permission to run dependency scripts from source analysis, vulnerability reports, and publisher checks. Each check answers a different question.

These controls work with npm, LPM.dev Registry, and private registries. Only @lpm.dev/* packages always use LPM.dev Registry.

# Install dependencies, then inspect blocked scripts
lpm install
lpm approve-scripts --list

# Fail on High and Critical vulnerabilities
lpm audit --level high --fail-on vuln

What happens by default

A successful install does not mean that an audit passed. Use lpm audit as an explicit CI gate.

Review and run dependency scripts

# Inspect one package before saving an approval
lpm approve-scripts esbuild --dry-run
lpm approve-scripts esbuild

# Run approved scripts
lpm rebuild

lpm approve-scripts saves trust. lpm rebuild runs eligible scripts.

New artifact approvals bind the package name, version, integrity, and lifecycle script hash. The hash includes recognized local JavaScript delegates and reachable imports.

A changed artifact needs another review. Legacy name approvals and trusted scopes also exist, with broader coverage.

The approval queue includes blocked dependency preinstall, install, and postinstall scripts. Other phases, such as dependency prepare, do not enter this queue.

Choose a script policy

Policy precedence is CLI flags, project lpm.scriptPolicy, user script-policy, then the default.

lpm install --triage --advisor=none
lpm config scripts --set deny

Eligibility does not itself run a script. Installation uses auto-build, configured auto-build, or an all-trusted package set to decide when to run eligible scripts.

The allow policy also requests automatic execution. Project lpm.scripts.denyAll suppresses dependency execution even if approvals exist.

Weaker policies can require security approval. An unattended flag cannot bypass the approved security floor.

Understand triage labels

Green, Amber, and Red describe static script classifications. They are separate from saved trust.

• Green: The command matches a recognized pattern. A local delegated file still needs review before automatic execution.
• Amber: The script needs explicit approval or an advisor decision.
• Red: Triage does not approve it automatically. A package with any Red phase is excluded from advisor review.

A matching repository URL can affect the displayed label. It does not approve delegated code. Explicit package or scope trust can authorize scripts with any label.

Keep sandbox policy separate

Sandbox mode controls how an eligible script runs. It does not grant script approval.

An approved allow-degraded setting can continue without full isolation when platform support is unavailable. This can include missing network isolation in strict mode.

lpm rebuild --strict-sandbox

Platform restrictions and permitted paths differ. See sandbox configuration and the script configuration.

On every platform, a sandboxed script can write only its own package's directory in the project's .lpm/, not other packages or LPM CLI's own state there. See the project's .lpm directory.

Inspect source behavior

lpm config source-analysis --set true
lpm --verbose install
lpm audit
lpm query ':eval:scripts'

Install-time source analysis inspects package code without running it. The install summary reports findings from the installed files and separately configured Registry enrichment.

Registry enrichment uses matching installed-version metadata. Missing or mismatched versions do not inherit findings from latest.

The summary is informational. --no-security-summary skips the post-install source scan, Registry enrichment, and report. It does not change script policy or explicit audits.

Behavioral tags describe capabilities and source patterns. Network access alone does not prove data theft. Environment access alone does not prove secret exposure.

lpm audit combines source findings with vulnerability and Registry reports. lpm query selects packages from its own inventory and analysis.

lpm trust inspects saved approvals and trust changes. These commands have different inventories and failure rules.

Local source analysis does not upload package source. Full analysis covers files up to 4 MiB. Larger files receive samples.

Each package has a 50 MiB scan budget and a 5,000-file limit. Missing inputs, unsupported syntax, or exceeded limits prevent a clean audit.

See source coverage for report fields and recovery. Disabling install-time analysis does not disable explicit audits.

Check vulnerabilities and publisher evidence

# Known vulnerabilities
lpm audit --fail-on vuln

# Hardcoded credentials are a separate scan
lpm audit --secrets --fail-on secrets

# npm-compatible registry signatures
lpm audit signatures

Vulnerability requests send package names and versions outside @lpm.dev/* to OSV, including names from private registries.

LPM.dev Registry supplies findings for its own packages. See audit network requests before use with confidential inventories.

These controls have separate scopes. Registry signature checks skip @lpm.dev/* and non-registry sources. LPM Firewall does not replace your npm registry.

Use an optional advisor

lpm install --triage --auto-build --advisor=ollama

# Change the local Ollama model for this invocation
LPM_TRIAGE_OLLAMA_MODEL=llama3.2 lpm install --triage --advisor=ollama

# Keep triage but disable the advisor for one invocation
lpm install --triage --advisor=none

Supported providers are none, claude-cli, codex, and ollama. Precedence is --advisor, project lpm.triageAdvisor, user triage-advisor, then none.

The advisor reviews every phase that needs automatic approval, including recognized delegated scripts. All reviewed phases must approve before the package qualifies.

A missing provider or failed preflight produces a warning. A failed individual classification withholds approval. Installation can continue with scripts blocked.

Data sent to the provider

The prompt contains package coordinates, lifecycle commands, the repository URL when present, and referenced script text.

Referenced-file context is limited to one level and 32 KiB per file. This context is narrower than the complete script hash.

claude-cli and codex use their configured services. Ollama uses the local server. Select a provider that matches your source-disclosure requirements.

Cached decisions and temporary approvals

The execution approval lasts for the current install. It does not write a persistent package trust entry.

Advisor verdicts are cached separately for 30 days by default. The cache includes reviewed content, the complete script hash, prompt template, and provider identity.

Ollama's configured model and endpoint also identify its cache. Changing the model selects a new cache entry.

The provider binary version is part of the identity. It does not guarantee an unchanged remote model or unchanged model weights under an existing name.

# Request a fresh decision without reading or writing the verdict cache
LPM_L4_CACHE=0 lpm install --triage --advisor=ollama

LPM_L4_CACHE_PATH changes the cache location. LPM_L4_CACHE_TTL_SECS changes the expiry period.

An approved package stays in the review queue if its scripts do not run, such as when denyAll suppresses auto-build.

Apply a CI policy

lpm install --frozen-lockfile
lpm audit --level high --fail-on vuln
lpm audit --secrets --fail-on secrets
lpm query ':credential-exfiltration' --assert-none

These checks do not prompt. The audit exits unsuccessfully for policy failures or incomplete scans. Query assertions fail when the selector matches packages.

For a reusable check, define an uncached task:

{
  "tasks": {
    "security:audit": {
      "command": "lpm audit --level high --fail-on vuln",
      "cache": false
    }
  }
}

lpm run security:audit

lpm.json has no dedicated security policy block. The task contains the command and flags. cache: false requests a current report each time.

Recover from a blocked operation

See also

• lpm install — install policy and lifecycle controls
• lpm audit — findings, coverage, and failure policies
• lpm approve-scripts — review exact artifacts
• lpm rebuild — run eligible dependency scripts
• lpm trust — inspect approvals and drift
• lpm query — select packages and assert policy
• lpm licenses — license inventory and CI gates
• lpm security — machine security approvals