registry / @cocoar/signalarrr / 5.1.0

@cocoar/signalarrr@5.1.0

TypeScript client for SignalARRR — type-safe RPC over SignalR

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed active attack surface exists in the inspected package snapshot. The install hook cannot copy its intended assets because they are absent.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

No observed file mutation or network activity from the install hook.

Mechanism

Guarded local skill-copy routine that exits when assets are absent

AI rationale

The postinstall routine would be concerning if bundled skill assets were present, but this exact snapshot lacks them and the source exits before copying. The remaining runtime networking is consistent with an RPC client and is user or server directed.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Evidence for AI clean decision

The manifest runs a postinstall script.
The postinstall code is designed to copy package skills into existing project .claude and .github directories.

Evidence against

The inspected snapshot contains no skills/ or docs/ assets, so postinstall exits before making changes.

@cocoar/signalarrr@5.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code