@1interface/chat-core@0.20.1
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe lifecycle hook is narrowly scoped dependency cleanup, and inspected runtime network and authentication behavior is consistent with a chat API client. No concrete malicious execution, credential harvesting, persistence, or agent control mutation was found.
Decision evidence
public snapshot- The postinstall hook removes only local node_modules/react and node_modules/react-dom directories; it does not modify agent controls or install a payload.
- Chat upload callers use shared-core API endpoint definitions, consistent with the package's authenticated API client.
- Location lookup obtains coordinates through browser geolocation and sends them to OpenStreetMap for reverse geocoding.
- The CommonJS entrypoint contains the same package-aligned reverse geocoding request.
Source & flagged code
6 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook removes only local node_modules/react and node_modules/react-dom directories; it does not modify agent controls or install a payload.
package.jsonView on unpkg · L59Findings
Affected versions and remediation
This report applies to @1interface/chat-core@0.20.1.
See all versions of @1interface/chat-core for other recorded verdicts.
- Review the evidence and your use of @1interface/chat-core@0.20.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.