registry / @clicktap/state / 1.2.2

@clicktap/state@1.2.2

A state management library for Clicktap reference frontend.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook is a local shell guard, and runtime networking is explicit application auth traffic to consumer-provided endpoints.

Static reason

One or more suspicious static signals were detected.

Trigger

Nested package installation invokes the guard; consumers explicitly dispatch auth actions to configured endpoints.

Impact

No unconsented mutation, payload execution, or exfiltration established.

Mechanism

Nested-install rejection and caller-configured fetch requests

AI rationale

The lifecycle script only aborts disallowed nested installs, while network behavior is package-aligned authentication against endpoints supplied by the consuming app. No concrete malicious chain was found.

Evidence

package.jsonAuthProvider-Ckh_jbpn.mjsrequest-VRlU6wWt.mjsenv-DQsuQljX.mjsheaders-CM2bJH0K.mjs

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a preinstall hook.

Evidence against

@clicktap/state@1.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code