@flexmr/survey-conversation
Generated package
This report shows the evidence for @flexmr/survey-conversation@10.0.12. 5 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package’s declared dependency triggers automatic disclosure of identifying environment and project data during installation. The source establishes the trigger, collected data, and recipient, supporting a block for an unconsented installation beacon.
Decision evidence
public snapshot- The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.
- The hook runs automatically during dependency installation, and the inspected source shows no installer consent check.
Source & flagged code
3 flagged · loading sourceThe package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.
package.jsonView on unpkg · L12The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.
Findings
Affected versions and remediation
This report applies to @flexmr/survey-conversation@10.0.12.
The versions list below shows the verdict for each recorded version.
- Avoid installing @flexmr/survey-conversation@10.0.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.