registry / @1interface/shared-core / 0.6.0
@1interface/shared-core@0.6.0
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe postinstall deletion is narrowly scoped to package-local React copies and aligns with the declared React peer dependencies. Bundled logging uses a configured endpoint, and inspection found no concrete attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
The package's postinstall lifecycle runs during installation.
Impact
The script can remove package-local copies of React dependencies; no broader consumer project mutation or malicious network behavior was established.
Mechanism
It runs `rm -rf` against relative paths for React and React DOM beneath the package's own node_modules directory. The bundled logger uses a configured OTLP endpoint.
AI rationale
The postinstall deletion is narrowly scoped to package-local React copies and aligns with the declared React peer dependencies. Bundled logging uses a configured endpoint, and inspection found no concrete attack behavior.
Evidence
node_modules/reactnode_modules/react-dom
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `package.json` defines a postinstall that removes `react` and `react-dom` only from its relative `node_modules` directory.
- `package.json` lists React and React DOM as peer dependencies, consistent with avoiding package-local duplicate copies.
- The bundled logger sends logs only to a caller-provided `otlpEndpoint`; no fixed external host was found.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedTrivialUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg67"scripts": {
"build": "vite build",
"dev": "vite build --watch",
"test": "vitest",
"test:ui": "vitest --ui",
"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
}
}
Low
Suspicious Lifecycle Evidence
`package.json` defines a postinstall that removes `react` and `react-dom` only from its relative `node_modules` directory.
package.jsonView on unpkg · L67Findings
1 High2 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @1interface/shared-core@0.6.0.
See all versions of @1interface/shared-core for other recorded verdicts.
- Review the evidence and your use of @1interface/shared-core@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.