@1interface/chat-core@0.22.0
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe postinstall hook performs an unconsented destructive mutation of the consumer project by deleting React dependencies. This concrete install-time behavior warrants blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
The package's postinstall hook runs during installation.
Impact
Consumer projects can lose their React dependencies and become unable to run or build.
Mechanism
The hook recursively removes node_modules/react and node_modules/react-dom from the install working directory.
Attack narrative
During installation, the package runs a postinstall command that recursively deletes React and React DOM from the consumer's node_modules. The manifest also declares both packages as peer dependencies, so the hook can remove dependencies needed by the consumer project.
AI rationale
The postinstall hook performs an unconsented destructive mutation of the consumer project by deleting React dependencies. This concrete install-time behavior warrants blocking publication.
Evidence
package.jsonnode_modules/reactnode_modules/react-dom
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines a postinstall script that recursively removes node_modules/react and node_modules/react-dom.
- The same manifest declares react and react-dom as peer dependencies.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
MinifiedTrivialUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg54"scripts": {
"build": "vite build",
"dev": "vite build --watch",
"test": "vitest",
"test:ui": "vitest --ui",
"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
}
}
High
Suspicious Lifecycle Evidence
package.json defines a postinstall script that recursively removes node_modules/react and node_modules/react-dom.
package.jsonView on unpkg · L5432"peerDependencies": {
"@reduxjs/toolkit": "^2.0.0",
"react": "^18.0.0 || ^19.0.0",
"react-dom": "^18.0.0 || ^19.0.0",
"react-re
High
Suspicious Dependency Evidence
The same manifest declares react and react-dom as peer dependencies.
package.jsonView on unpkg · L32Findings
3 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Dependency Evidencepackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @1interface/chat-core@0.22.0.
See all versions of @1interface/chat-core for other recorded verdicts.
- Avoid installing @1interface/chat-core@0.22.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.