registry  /  @frmds/format  /  1.0.2

@frmds/format@1.0.2

Format JSON files with Cataclysm: Dark Days Ahead's own formatter

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Installation performs first-party Frontier plugin registration; explicit command execution formats selected JSON files using a discovered local game binary.

Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; later explicit `frontier run format`
Impact
Registers a package-owned Frontier command and can modify JSON files only when the user runs it.
Mechanism
first-party plugin registration and user-invoked local formatter spawn
Rationale
Source inspection shows a package-aligned Frontier plugin lifecycle hook and an explicit formatting command, with no exfiltration, remote payload loading, stealth persistence, or foreign control-surface mutation. The scanner signal is explained by the first-party lifecycle registration.
Evidence
package.jsonREADME.mddist/plugin.jsdist/command.jsdist/discover.jsdist/install.jsdist/locate.jsdist/pick.jsdist/run.js

Decision evidence

public snapshot
AI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for block
  • `package.json` postinstall registers plugin via `frontier plugins add`.
  • `dist/run.js` spawns a locally resolved game `json_formatter` binary.
Evidence against
  • No network, credential, or environment harvesting found in package source.
  • `dist/plugin.js` registers only the package's `format` command.
  • `dist/command.js` runs formatting only after explicit `frontier run format`.
  • `dist/discover.js` targets only user-selected/current-directory `.json` files.
  • `preuninstall` removes the same first-party plugin registration.
Behavioral surface
Source
ChildProcessFilesystem
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 8.49 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = frontier plugins add @frmds/format || exit 0
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = frontier plugins add @frmds/format || exit 0
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem