registry / @1interface/shared-core / 0.10.0

@1interface/shared-core@0.10.0

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installing the package deletes React and React DOM from the consuming installation. This can break the consumer project and remove its required dependencies.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installs this package and runs its postinstall lifecycle hook.

Impact

Destructive dependency removal and denial of service for projects using React.

Mechanism

Unconditional recursive deletion of consumer dependency directories.

Attack narrative

The package's postinstall hook automatically runs a recursive deletion command against React and React DOM directories. It suppresses errors and succeeds even after deletion, making the behavior silent. Because these are peer dependencies required by the distributed code, removing them from a consumer installation is destructive and has no legitimate package setup purpose visible in the source.

AI rationale

The package contains a concrete automatic destructive action against consumer dependencies. No source evidence justifies this install-time deletion.

Evidence

package.jsonnode_modules/reactnode_modules/react-dom

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

@1interface/shared-core@0.10.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code