registry  /  @ivuorinen/browserslist-config  /  1.2.10

@ivuorinen/browserslist-config@1.2.10

ivuorinen's shareable configuration for Browserslist.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation executes a lifecycle script that can create the consuming project's `.browserslistrc`. The write is limited to an absent Browserslist config and contains `extends @ivuorinen/browserslist-config`.

Static reason
One or more suspicious static signals were detected.
Trigger
npm installation with lifecycle scripts enabled and no detected Browserslist config
Impact
Mutates a project configuration file without an explicit follow-up command; no exfiltration or remote execution is established.
Mechanism
postinstall project configuration write
Rationale
The package has a real, documented postinstall mutation of the consumer project, so it should be warned rather than treated as clean. The source does not establish malicious behavior or a broader control-surface compromise.
Evidence
package.jsonscripts/postinstall.cjsindex.cjswrapper.mjsREADME.md.browserslistrc

Decision evidence

public snapshot
AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `package.json` runs `postinstall` automatically.
  • `scripts/postinstall.cjs` writes `.browserslistrc` under `INIT_CWD` when absent.
  • The install hook exits only after detecting an existing Browserslist config.
Evidence against
  • `index.cjs` exports only a static Browserslist array.
  • `wrapper.mjs` only re-exports `index.cjs`.
  • No network, shell execution, eval, credential harvesting, or payload loading appears in package files.
  • README documents the automatic project config creation.
Behavioral surface
Source
EnvironmentVarsFilesystem
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 1.01 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
LowScripts Present
LowFilesystem