registry / @1interface/shared-core / 0.2.0

@1interface/shared-core@0.2.0

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. Installation runs a narrowly scoped relative cleanup command; runtime network logging requires application-provided configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; runtime caller invokes `initLogger` with `otlpEndpoint`

Impact

No confirmed exfiltration, persistence, or destructive behavior beyond the package-local cleanup target.

Mechanism

relative dependency cleanup and opt-in telemetry export

Rationale

Direct inspection shows a shared-core library with caller-configured telemetry, not an autonomous payload. The postinstall hook is unusual but narrowly relative and does not establish a malicious chain.

Evidence

package.jsondist/index.mjsdist/index.jsdist/index.d.tsnode_modules/reactnode_modules/react-dom

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

`package.json` has a `postinstall` hook that runs `rm -rf` on two relative `node_modules` paths.

@1interface/shared-core@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code