registry / @clicktap/state / 3.5.2

@clicktap/state@3.5.2

A state management library for Clicktap reference frontend.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No attack was identified. The preinstall hook rejects a nested installation, and the inspected authentication code uses endpoints supplied to its caller.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation or caller-invoked authentication refresh.

Impact

The install guard can stop a nested install. No malicious impact is established by the inspected source.

Mechanism

The preinstall script checks the install location; authentication refresh posts its token to the configured server endpoint.

AI rationale

The preinstall hook is a location guard, and inspected network activity is part of caller-configured authentication. No concrete malicious behavior was found.

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a preinstall guard that rejects nested installs and explains the monorepo-root requirement.
Authentication refresh sends a refresh token to the configured server endpoint as a POST request.
The shared request helper performs fetch using the endpoint and options supplied by its caller.

Evidence against

@clicktap/state@3.5.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code