registry / @1interface/shared-core / 0.8.0

@1interface/shared-core@0.8.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically removes two consumer dependencies. This is an unconsented destructive install-time mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, including a transitive installation that runs postinstall

Impact

It can break the consumer application and force dependency repair or replacement.

Mechanism

A postinstall shell command recursively deletes React packages.

Attack narrative

During installation, npm runs the package's postinstall command. That command recursively removes node_modules/react and node_modules/react-dom in the consuming project, discarding errors to avoid visible failure. The behavior is unrelated to providing a shared core library and directly disrupts the consumer's dependency tree.

Rationale

The package contains a concrete, automatic destructive install hook targeting consumer dependencies. This warrants blocking regardless of otherwise ordinary runtime library code.

Evidence

package.jsonnode_modules/reactnode_modules/react-dom

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The automatic postinstall hook recursively deletes the consumer's React and React DOM packages, while suppressing errors.

@1interface/shared-core@0.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code