registry / @blksails/pi-web-react / 0.2.0

@blksails/pi-web-react@0.2.0

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A host application can invoke the exported extension loader to fetch and import a runtime extension URL. No install-time or autonomous attack behavior is present.

Static reason

No blocking static signals were detected.

Trigger

Host application calls loadExtension or browserLoaderDeps with an extension manifest and base URL.

Impact

A trusted or integrity-matched extension gains browser-module execution in the host context.

Mechanism

Guarded remote extension fetch and dynamic import

Rationale

No malicious chain was found, but the exported guarded remote-extension lifecycle is a real high-impact capability whose signature requirement is caller-configurable. It warrants a warning under the extension-lifecycle policy, not a block.

Evidence

package.jsonsrc/web-ext/extension-loader.tssrc/web-ext/extension-gate.tssrc/client/pi-client.tssrc/client/request.ts

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

src/web-ext/extension-loader.ts fetches and dynamically imports extension entry URLs at runtime.

@blksails/pi-web-react@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code