registry / @fayz-ai/portal / 0.66.0
@fayz-ai/portal@0.66.0
Fayz SDK member/learner portal scaffold — authenticated 'my courses' + player surface
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no install-time execution or credential transfer to an unrelated recipient. The observed network and account operations serve the configured portal services and course workflow.
Static reason
No blocking static signals were detected.
Trigger
The package has no install lifecycle hook; runtime behavior begins when the application initializes the portal or a member uses it.
Impact
No malicious impact was established from these package-aligned behaviors.
Mechanism
Login uses the configured auth adapter, connectivity checks target the configured Supabase service, and optional auto-enrollment uses the configured course provider.
AI rationale
Source inspection found no install-time execution or credential transfer to an unrelated recipient. The observed network and account operations serve the configured portal services and course workflow.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest lists build, development, typecheck, and cleanup scripts, with no install lifecycle hook.
- The inspected core, auth, and courses dependency manifests show ordinary build and development scripts; their entrypoints expose portal, auth, and course APIs.
- The portal passes entered login credentials to its selected adapter; the Supabase adapter uses the configured service URL and sends credentials through that service's password sign-in API.
- The core connectivity probe builds its health-check URL from the configured Supabase URL and performs a request only through connectivity handling.
- The portal's auto-enrollment behavior enrolls a signed-in member in published courses from the configured provider; it is an explicit portal setting and is part of the course-access workflow.
Evidence against
Behavioral surface
HighEntropyStrings
Source & flagged code
8 flaggedpackage.jsonView file
50"scripts": {
"build": "tsup && tsc -b --force",
"dev": "tsup --watch",
"typecheck": "tsc -b",
"clean": "rm -rf dist .tsbui
Low
Suspicious Lifecycle Evidence
The package manifest lists build, development, typecheck, and cleanup scripts, with no install lifecycle hook.
package.jsonView on unpkg · L50.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/0/npm-linux/package.jsonView file
112"scripts": {
"build": "node ./scripts/check-access-purity.mjs && tsup && tsc -b --force",
"check:manifest": "node ./scripts/check-manifest-contract.mjs",
"check:access": "node ./scripts/check-access-purity.mjs",
"dev": "tsup --watch
Low
Suspicious Dependency Evidence
The inspected core, auth, and courses dependency manifests show ordinary build and development scripts; their entrypoints expose portal, auth, and course APIs.
.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/0/npm-linux/package.jsonView on unpkg · L112Findings
10 Low
LowScripts Present
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/1/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/1/npm-linux/dist/index.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/2/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/2/npm-linux/dist/index.js
LowAi Review Evidence.lpm-dependency-evidence-a349353c-1986-4509-be64-b76ffcab0f2b/1/npm-linux/dist/chunk-BGCCXJJA.js
Affected versions and remediation
This report applies to @fayz-ai/portal@0.66.0.
See all versions of @fayz-ai/portal for other recorded verdicts.
- Review the evidence and your use of @fayz-ai/portal@0.66.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.