registry / @buntok/core / 1.0.3

@buntok/core@1.0.3

Core HTTP framework for Bun — Express-like, bring your own structure

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The postinstall hook overwrites README.md in the npm-invoking project directory. This is an unconsented destructive project-file mutation, with no confirmed exfiltration or remote execution.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install of @buntok/core

Impact

Existing project documentation is destroyed or replaced.

Mechanism

postinstall copies the package README over the project README

Rationale

The package is not shown to be malicious, but its automatic install hook performs an unnecessary, unconsented overwrite of a consumer project file. This concrete destructive behavior warrants a warning rather than publication blocking under the stated policy.

Evidence

package.jsonscripts/postinstall.mjsdist/core-exports.cjsREADME.md<project-root>/README.md

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Install hook runs automatically after npm installation.
Hook selects the invoking project directory as its target.

@buntok/core@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code