registry / @1interface/chat-core / 0.15.5
@1interface/chat-core@0.15.5
AI Security Review
scanned 20d ago · by lpm-firewall-aiInspected source supports ordinary chat-client functionality and narrowly scoped dependency cleanup. The network, environment-variable, and lifecycle signals do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Installation activates dependency cleanup; application calls activate network features.
Impact
Dependency cleanup may affect React resolution, and location lookup shares coordinates with the geocoding service; no covert harvesting or payload execution was established.
Mechanism
The hook deletes two relative dependency directories. Runtime helpers send application requests and perform browser-mediated reverse geocoding.
AI rationale
Inspected source supports ordinary chat-client functionality and narrowly scoped dependency cleanup. The network, environment-variable, and lifecycle signals do not establish malicious behavior.
Evidence
node_modules/reactnode_modules/react-dom
Network endpoints1
nominatim.openstreetmap.org
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook only removes node_modules/react and node_modules/react-dom.
- The runtime entrypoint imports the declared React, Redux, shared-core, and streaming dependencies.
- Login sends caller-supplied credentials to the configured authentication API.
- The location feature uses browser geolocation and sends coordinates to OpenStreetMap for reverse geocoding.
- The exported request helper handles application authentication as a configurable API client.
Evidence against
- The install hook deletes dependency directories, which can affect dependency resolution.
- Location lookup shares browser-approved coordinates with an external geocoding service.
Behavioral surface
EnvironmentVarsNetwork
MinifiedTrivialUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg59"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
}
}
Low
Suspicious Lifecycle Evidence
The postinstall hook only removes node_modules/react and node_modules/react-dom.
package.jsonView on unpkg · L59dist/index.jsView file
Findings
1 High3 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencedist/index.js
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @1interface/chat-core@0.15.5.
See all versions of @1interface/chat-core for other recorded verdicts.
- Review the evidence and your use of @1interface/chat-core@0.15.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.