@buntok/core@1.0.2
Core HTTP framework for Bun — Express-like, bring your own structure
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe unconsented postinstall overwrite of a broad consumer project file establishes concrete destructive behavior. This supports blocking publication as install_hook_abuse.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package when npm runs its postinstall lifecycle hook.
Impact
Existing consumer documentation is overwritten without a consent check.
Mechanism
The hook resolves the project root from INIT_CWD or the current directory, then writes the package README to that root's README.md even when that file already exists.
Attack narrative
During postinstall, the package targets the consumer project's root README.md and unconditionally writes its own README content there. An existing README is overwritten, creating an install-time destructive effect.
AI rationale
The unconsented postinstall overwrite of a broad consumer project file establishes concrete destructive behavior. This supports blocking publication as install_hook_abuse.
Evidence
package.jsonscripts/postinstall.mjsREADME.md
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/postinstall.mjs automatically during postinstall.
- The hook selects the invoking project root and targets its README.md.
- The hook overwrites an existing root README.md with this package's README without a consent check.
Evidence against
- The copied content comes from this package's README.md.
- The inspected hook does not show network access or credential handling.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystem
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg27"postinstall": "node scripts/postinstall.mjs"
},
"keywords
High
Suspicious Lifecycle Evidence
package.json runs scripts/postinstall.mjs automatically during postinstall.
package.jsonView on unpkg · L27•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/core-exports.cjsView file
Findings
4 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/postinstall.mjs
HighAi Review Evidencescripts/postinstall.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/core-exports.cjs
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @buntok/core@1.0.2.
See all versions of @buntok/core for other recorded verdicts.
- Avoid installing @buntok/core@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.