registry / @feedmepos/mf-payment / 1.11.5

@feedmepos/mf-payment@1.11.5

Development always based on production and add "-beta.version" in behind. Every deployment from development to production will increment based on semantic versioninig.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installing the package automatically invokes pnpm against an adjacent project path. This can mutate that other project's installation state and trigger its lifecycle scripts.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation of this package

Impact

Unconsented dependency changes and lifecycle execution in an external sibling project.

Mechanism

postinstall launches a sibling-project dependency installation

Rationale

The automatic cross-project install is unsafe and unexplained, but the inspected source does not prove a concrete malicious payload. Treat it as an install-hook abuse risk requiring a warning.

Evidence

package.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Its automatic postinstall runs pnpm install in a relative sibling project, outside the installed package.
That command can alter the sibling project's dependency tree and execute its lifecycle hooks without a user command.

Evidence against

The manifest has no dependency on this package's own name, so no nested self-dependency lifecycle chain is present.

@feedmepos/mf-payment@1.11.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code