registry  /  @frmds/init  /  1.0.1

@frmds/init@1.0.1

Initialize a new Frontier mod structure

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Install lifecycle registers/removes this package with the Frontier plugin system, and user-invoked runtime scaffolds local mod files without overwriting existing files.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install/uninstall for lifecycle registration; `frontier run init` for scaffolding
Impact
Creates expected mod scaffold files only when invoked; lifecycle registration is package-aligned.
Mechanism
Frontier plugin registration and local template scaffolding
Rationale
Static inspection shows a small Frontier plugin whose lifecycle scripts register the plugin and whose runtime command copies bundled scaffold templates into the user's current project. No exfiltration, persistence, destructive behavior, remote code execution, or AI-agent control-surface mutation was found.
Evidence
package.jsondist/plugin.jsdist/commands/init.jstemplates/modinfo.jsontemplates/frontier.json5templates/gitignoreREADME.md

Decision evidence

public snapshot
AI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for block
  • package.json has postinstall/preuninstall lifecycle scripts invoking `frontier plugins add/remove @frmds/init`.
Evidence against
  • dist/plugin.js only registers an `init` command for the Frontier plugin system.
  • dist/commands/init.js only copies bundled templates and creates `src/` in the current working directory when the command is run.
  • No child_process, eval/vm/Function, dynamic loading, credential access, env harvesting, or runtime network calls found.
  • Templates contain only `frontier.json5`, `.gitignore`, and a basic `modinfo.json` scaffold.
  • Lifecycle behavior is package-aligned plugin registration documented in README.md.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.68 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = frontier plugins add @frmds/init || exit 0
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = frontier plugins add @frmds/init || exit 0
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowNon Install Lifecycle Scripts
LowScripts Present