registry / @clicktap/state / 0.19.0

@clicktap/state@0.19.0

A state management library for Clicktap reference frontend.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The preinstall hook only guards against nested installation; runtime requests are activated by consumer-supplied authentication/checkout configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

Nested npm install invokes the guard; consumer authentication or checkout actions invoke configured requests.

Impact

No unconsented persistence, file mutation, credential harvesting, or exfiltration established.

Mechanism

install-location validation and caller-configured GraphQL/auth requests

AI rationale

Static source inspection supports a benign frontend state library. The scanner signals arise from a non-mutating install guard and expected configured web requests.

Evidence

package.jsonindex.jsindex.mjs

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a preinstall hook.

Evidence against

package.json preinstall only rejects nested installs; it does not write files or invoke network/shell payloads.

@clicktap/state@0.19.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code