registry / @accenturecodefoundry/mfe-pot-shared-ui-scds-core / 99.99.1

@accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.1

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The manifest contains no install-time commands, and the only runtime entrypoint contains no executable code. The inspected package files provide no evidence of malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

No executable install hook or entrypoint behavior was present to activate.

Impact

No package behavior that could cause an attack or impact was identified.

Mechanism

The manifest declares empty install commands, and the entrypoint has no executable implementation.

AI rationale

The manifest contains no install-time commands, and the only runtime entrypoint contains no executable code. The inspected package files provide no evidence of malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points the main entry at index.js and declares empty preinstall and postinstall commands.
The complete entrypoint file contains no executable implementation.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 57 B of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

1{ "name": "@accenturecodefoundry/mfe-pot-shared-ui-scds-core", "version": "99.99.1", "description": "A simple placeholder for npm.", "main": "index.js", "scripts": { "preinstall": "", "postinstall": "" }, "keywords": [], "author": "anonymous", "license": "ISC" }

Low

Suspicious Lifecycle Evidence

The manifest points the main entry at index.js and declares empty preinstall and postinstall commands.

package.jsonView on unpkg · L1

index.jsView file

1// This is a benign placeholder for the Node.js package.

Low

Ai Review Evidence

The complete entrypoint file contains no executable implementation.

index.jsView on unpkg · L1

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceindex.js

Affected versions and remediation

This report applies to @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.1.

See all versions of @accenturecodefoundry/mfe-pot-shared-ui-scds-core for other recorded verdicts.

Review the evidence and your use of @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 16:30:36.617Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.