registry / @1interface/shared-core / 0.7.0

@1interface/shared-core@0.7.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically removes React and React DOM from the consumer project's node_modules. This can break the consumer application and its dependency tree.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

Destructive install-time sabotage of React-based projects.

Mechanism

Recursive deletion of consumer dependencies with errors ignored.

Attack narrative

During package installation, npm invokes the declared postinstall command. It recursively deletes node_modules/react and node_modules/react-dom in the consuming project, while redirecting errors and returning success. This alters unrelated consumer dependencies without a user action and can leave the application broken or in an inconsistent state.

Rationale

The manifest contains a concrete, automatic, destructive lifecycle command targeting unrelated consumer dependencies. The behavior is not required for a shared runtime library and is sufficient to classify the package as malicious.

Evidence

package.jsonnode_modules/reactnode_modules/react-dom

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

@1interface/shared-core@0.7.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code