registry / @100xprompt/cli-darwin-x64 / 0.1.50

@100xprompt/cli-darwin-x64@0.1.50

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Installation invokes macOS codesign only on the package-owned executable. No confirmed attack surface beyond that local re-signing step.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Changes the code signature of bin/100xprompt; no foreign files or network endpoints are used by the lifecycle script.

Mechanism

removes and ad-hoc re-signs the bundled executable

Rationale

The flagged lifecycle hook is limited to the package's own native binary and does not mutate a foreign or AI-agent control surface. Native-binary and embedded-runtime indicators alone do not establish malicious behavior.

Evidence

package.jsonbin/100xprompt

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines a postinstall shell command.
Postinstall removes and ad-hoc re-signs bin/100xprompt.

Evidence against

The lifecycle command targets only ./bin/100xprompt.
No other package files or lifecycle entrypoints exist.

@100xprompt/cli-darwin-x64@0.1.50

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code