registry / @ivuorinen/browserslist-config / 1.2.12

@ivuorinen/browserslist-config@1.2.12

ivuorinen's shareable configuration for Browserslist.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The package has an install-time project-file mutation. It creates a package-aligned `.browserslistrc` in `INIT_CWD` only when no Browserslist config is detected; no exfiltration or remote execution was found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation executes `postinstall`.

Impact

Modifies the consuming project configuration without an explicit setup command.

Mechanism

Conditional creation of a Browserslist configuration file.

Rationale

Source inspection confirms an unconsented postinstall project-config write, but no concrete malicious behavior. Treat it as a warning for install-time mutation rather than a publish-block threat.

Evidence

package.jsonscripts/postinstall.cjsindex.cjswrapper.mjs${INIT_CWD}/.browserslistrc

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`package.json` runs `node scripts/postinstall.cjs` at install time.
`scripts/postinstall.cjs` writes `${INIT_CWD}/.browserslistrc` when no existing Browserslist config is found.

@ivuorinen/browserslist-config@1.2.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code