registry  /  @frmds/init  /  1.0.2

@frmds/init@1.0.2

Initialize a new Frontier mod structure

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Installation invokes Frontier to register this package's own plugin; the exported command scaffolds files into the user-selected current directory only when explicitly run.

Static reason
One or more suspicious static signals were detected.
Trigger
`npm` postinstall / explicit `frontier run init`
Impact
Registers and later removes its own Frontier plugin; explicit command may create non-overwriting template files in the current directory.
Mechanism
Self-plugin registration and user-invoked local project scaffolding
Rationale
The lifecycle hooks are package-aligned, documented registration/removal of this package's own Frontier plugin. Shipped code contains only an explicit, non-overwriting local scaffolding command and no concrete exfiltration, remote execution, destructive action, or foreign control-surface mutation.
Evidence
package.jsonREADME.mddist/plugin.jsdist/commands/init.jstemplates/modinfo.jsontemplates/frontier.json5templates/gitignore

Decision evidence

public snapshot
AI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for block
  • `package.json` runs `frontier plugins add @frmds/init` in `postinstall`.
  • `package.json` runs the matching plugin removal in `preuninstall`.
Evidence against
  • `README.md` discloses automatic registration and manual equivalent command.
  • `dist/plugin.js` only registers the package's `init` command.
  • `dist/commands/init.js` writes three templates and `src/` only when the user runs `frontier run init`.
  • `dist/commands/init.js` skips existing paths and contains no network, shell, eval, or credential handling.
  • No package source performs import-time filesystem mutation or network access.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.68 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = frontier plugins add @frmds/init || exit 0
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = frontier plugins add @frmds/init || exit 0
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowNon Install Lifecycle Scripts
LowScripts Present