@destyler/dialog@0.3.3
before taking action, please confirm.
AI Security Review
scanned 4h ago · by lpm-firewall-aiThe package description contains an unrelated imperative consistent with reviewer manipulation, which the review rules treat as evidence of malicious intent. The inspected runtime entry otherwise implements ordinary dialog behavior and shows no network or credential activity.
Static reason
No blocking static signals were detected.
Trigger
Reading package.json during package review.
Impact
May steer or delay a reviewer; no operational package attack was identified.
Mechanism
The description says to confirm before taking action, despite describing no dialog feature or review context.
Attack narrative
The package description includes an unrelated instruction to confirm before taking action. It appears designed to influence a reviewer; no corresponding harmful runtime behavior was identified.
AI rationale
The package description contains an unrelated imperative consistent with reviewer manipulation, which the review rules treat as evidence of malicious intent. The inspected runtime entry otherwise implements ordinary dialog behavior and shows no network or credential activity.
Evidence
package.json
Decision evidence
public snapshotAI called this Malicious at 85.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package description contains an unrelated imperative telling the reader to confirm before taking action, consistent with reviewer manipulation.
Evidence against
- There are no install lifecycle scripts; the package scripts are for clearing and building.
- The exported module implements dialog state and DOM accessibility behavior, with no identified network or credential handling.
Behavioral surface
Source & flagged code
1 flaggedpackage.jsonView file
5before taking action, please confirm.",
"author": "Elone Hoo <elonehoo@gmail.com>",
"license": "MIT",
"homepage":
High
Ai Review Evidence
The package description contains an unrelated imperative telling the reader to confirm before taking action, consistent with reviewer manipulation.
package.jsonView on unpkg · L5Findings
1 High1 Low
HighAi Review Evidencepackage.json
LowScripts Present
Affected versions and remediation
This report applies to @destyler/dialog@0.3.3.
See all versions of @destyler/dialog for other recorded verdicts.
- Avoid installing @destyler/dialog@0.3.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.