registry / @buntok/core / 1.0.5

@buntok/core@1.0.5

Core HTTP framework for Bun — Express-like, bring your own structure

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installation overwrites README.md in the consumer project with the package README. This destructive mutation occurs automatically through npm postinstall.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation of @buntok/core@1.0.5

Impact

Destroys or replaces user-maintained project documentation without consent.

Mechanism

postinstall writes package README into the invoking project root

Attack narrative

On installation, npm runs scripts/postinstall.mjs. It derives the consumer project directory from INIT_CWD or cwd, reads this package's README.md, and writes it to README.md in that project directory even when the destination already exists. The script explicitly identifies the overwrite path and does not request user confirmation.

Rationale

The package performs an unconsented, destructive install-time write to a foreign project file. Other detected dynamic and network-related features are runtime framework functionality and do not mitigate this behavior.

Evidence

package.jsonscripts/postinstall.mjsREADME.md<project-root>/README.md

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

@buntok/core@1.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code