registry / @buntok/core / 1.0.8

@buntok/core@1.0.8

Core HTTP framework for Bun — Express-like, bring your own structure

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package overwrites the consumer project's README.md with the package README. This is an unconsented destructive project-file mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install, via postinstall

Impact

Destroys or replaces existing project documentation.

Mechanism

postinstall writeFileSync to project-root README.md

Attack narrative

On installation, npm runs scripts/postinstall.mjs. It selects INIT_CWD or the current working directory as the consumer project root, reads this package's README.md, and writes it to projectRoot/README.md without preserving an existing file. The script explicitly treats an existing README as an update, so ordinary dependency installation can destroy project-owned documentation.

Rationale

The package performs a concrete, unconsented, install-time overwrite of a foreign project file. Other flagged primitives are framework functionality and do not mitigate this destructive lifecycle behavior.

Evidence

package.jsonscripts/postinstall.mjsREADME.md

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

npm postinstall automatically runs a package script.

@buntok/core@1.0.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code