registry / @buntok/core / 1.0.6

@buntok/core@1.0.6

Core HTTP framework for Bun — Express-like, bring your own structure

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation unconditionally replaces the consuming project's README.md with this package's README. No network or credential-exfiltration path was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install

Impact

Destructive modification of a user project file.

Mechanism

postinstall overwrite of project-root README

Rationale

The postinstall behavior creates a concrete destructive side effect outside the package. It warrants a warning, not a block under the install-control-surface policy because it does not target an AI-agent control surface or establish a broader malicious chain.

Evidence

package.jsonscripts/postinstall.mjsdist/core-exports.jsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

npm postinstall runs a filesystem-writing script.
The script overwrites the invoking project's README.md without consent or backup.

Evidence against

@buntok/core@1.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code