registry / @clicktap/state / 3.0.8

@clicktap/state@3.0.8

A state management library for Clicktap reference frontend.

AI Security Review

scanned 29d ago · by lpm-firewall-ai

Installing the package runs a shell preinstall hook. For ordinary dependency installation, the installed package path is beneath the invoking project directory, so the hook terminates the install.

Static reason

One or more suspicious static signals were detected.

Trigger

npm package installation.

Impact

It can deny consumers installation of this package and abort the wider dependency install.

Mechanism

Install-time path check followed by a forced failure.

Attack narrative

The package defines a preinstall lifecycle shell command. It compares the package manager's invoking directory with the current package directory and exits with status 1 when the package resides beneath that invoking directory. That is the normal layout for installing a registry dependency, so the hook can intentionally break consumer installs before the library is used.

AI rationale

The package contains a concrete install-time denial-of-service hook rather than a normal library setup action. Runtime network calls are user-triggered authentication requests and do not reduce the install-hook risk.

Evidence

package.json

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook checks consumer installation paths and deliberately exits with status 1 when the package is installed under the invoking directory.

@clicktap/state@3.0.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code