registry / @clicktap/state / 1.2.3

@clicktap/state@1.2.3

A state management library for Clicktap reference frontend.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The only lifecycle hook is a local nested-install guard; runtime network requests use application-supplied endpoints after auth or commerce actions.

Static reason

One or more suspicious static signals were detected.

Trigger

Install invokes the guard; consumers explicitly invoke auth/commerce state transitions for network requests.

Impact

No unconsented mutation, credential harvesting, or exfiltration chain established.

Mechanism

Nested-install validation and caller-configured frontend state management.

AI rationale

Static inspection shows a normal frontend state package. Scanner signals map to a harmless install guard, NODE_ENV checks, and user-configured authentication requests.

Evidence

package.jsonrequest-VRlU6wWt.mjsAuthProvider-Ckh_jbpn.mjsenv-DQsuQljX.mjsheaders-CM2bJH0K.mjs

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json preinstall only rejects nested installs and performs no file, network, or shell mutation.

@clicktap/state@1.2.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code