registry / @1interface/shared-core / 0.1.0

@1interface/shared-core@0.1.0

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The lifecycle script deletes nested React copies under the package install directory, and runtime network behavior is app logging/assets driven by exported library configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install for postinstall; application runtime when consumers call exported helpers

Impact

No confirmed unauthorized persistence, exfiltration, or AI-agent control mutation

Mechanism

package-local dependency cleanup and configurable app telemetry helpers

Rationale

Static inspection shows a shared React/app utility package with a questionable but package-local postinstall cleanup and configurable telemetry code, not concrete malware. No install-time foreign control-surface mutation, secret harvesting, persistence, or hardcoded exfiltration was found.

Evidence

package.jsondist/index.jsdist/index.mjsdist/index.d.tsnode_modules/reactnode_modules/react-dom

Network endpoints1

one-interface-assets.nyc3.cdn.digitaloceanspaces.com/Orb.mp4

Decision evidence

public snapshot

with false-positive risk.

@1interface/shared-core@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code