registry / @1interface/shared-core / 0.16.0
@1interface/shared-core@0.16.0
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found a package-local dependency cleanup hook and a configurable OTLP logging path, with no concrete attack behavior identified. The scanner’s lifecycle and network flags alone do not establish maliciousness.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall command; runtime logging requires logger initialization with an OTLP endpoint outside development mode.
Impact
No confirmed attack surface was established from these behaviors.
Mechanism
The install command targets node_modules/react and node_modules/react-dom relative to the package directory. The logger POSTs queued logs to its configured endpoint.
AI rationale
Source inspection found a package-local dependency cleanup hook and a configurable OTLP logging path, with no concrete attack behavior identified. The scanner’s lifecycle and network flags alone do not establish maliciousness.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall command removes only package-local node_modules/react and node_modules/react-dom paths.
- The CommonJS entrypoint resolves to dist/index.js.
- The logger creates a network sink only when given an OTLP endpoint outside development mode; its POST sends queued log records to that configured endpoint.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedTrivialUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg72"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
}
}
Low
Suspicious Lifecycle Evidence
The postinstall command removes only package-local node_modules/react and node_modules/react-dom paths.
package.jsonView on unpkg · L7214"require": "./dist/index.js"
},
"./text-direction": {
"types": "./dist/text-direction.d.ts",
"import": "./dist/text-direction.mjs",
"require": "./dist/tex
Findings
1 High2 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @1interface/shared-core@0.16.0.
See all versions of @1interface/shared-core for other recorded verdicts.
- Review the evidence and your use of @1interface/shared-core@0.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.