registry / @clicktap/state / 1.2.0

@clicktap/state@1.2.0

A state management library for Clicktap reference frontend.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. Installation only runs a local nested-install guard; runtime requests require application-provided endpoints and explicit auth or commerce actions.

Static reason

One or more suspicious static signals were detected.

Trigger

Nested npm install, or consumer-triggered authentication/checkout actions after endpoint configuration.

Impact

No unconsented persistence, host mutation, credential harvesting, or exfiltration established.

Mechanism

Local install guard plus caller-configured HTTP requests.

AI rationale

The lifecycle hook is a non-mutating local install-policy check. Network and credential handling are explicit frontend auth/checkout functionality directed to endpoints supplied by the consuming application.

Evidence

package.jsonAuthProvider-hF8_sfns.mjsCheckoutProvider-tvQcw4I2.mjsrequest-VRlU6wWt.mjsenv-DQsuQljX.mjs

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a preinstall shell guard.

Evidence against

@clicktap/state@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code