registry / @clicktap/state / 1.2.1

@clicktap/state@1.2.1

A state management library for Clicktap reference frontend.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook is a local nested-install guard, and runtime HTTP calls require host-provided endpoints and explicit auth or checkout actions.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install for the guard; consumer-driven authentication or checkout events for runtime requests

Impact

No unconsented mutation, exfiltration, remote payload execution, or persistence established.

Mechanism

local install validation and injected-endpoint HTTP state management

AI rationale

Static hints arise from a benign install guard, NODE_ENV detection, and ordinary consumer-configured auth/GraphQL networking. Source inspection found no concrete malicious chain.

Evidence

package.jsonindex.mjsAuthProvider-hF8_sfns.mjsrequest-TlXquiLY.jsquote/transport.d.tsenv-D5GsAQ-U.js

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a preinstall hook.

Evidence against

@clicktap/state@1.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code