registry / @clicktap/state / 3.5.1

@clicktap/state@3.5.1

A state management library for Clicktap reference frontend.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No attack was identified. The install hook blocks a nested install, and the inspected authentication requests use endpoints supplied by the application.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation or application invocation of the authentication flow.

Impact

No confirmed malicious effect or package-controlled exfiltration destination was established.

Mechanism

The preinstall guard rejects a particular install-directory context; authentication sends credentials or refresh tokens to caller-supplied service endpoints.

AI rationale

The install hook is a narrowly scoped monorepo-install guard. Inspected auth requests target supplied endpoints as part of ordinary authentication, with no evidence of an unrelated recipient or other attack behavior.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The preinstall hook only rejects installs run from inside the library directory.
Authentication requires an endpoint supplied through the auth input; no package-controlled destination is established.
The server refresh flow sends its refresh token to the supplied server endpoint.

@clicktap/state@3.5.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code