registry / @ivuorinen/stylelint-config / 1.2.2

@ivuorinen/stylelint-config@1.2.2

ivuorinen's shareable configuration for stylelint.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook performs package-aligned project setup by creating .stylelintrc.json only if an existing stylelint config is not found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install lifecycle postinstall

Impact

May create a project .stylelintrc.json during install; no exfiltration or code execution beyond the lifecycle script itself was found.

Mechanism

documented stylelint config bootstrap

Rationale

The postinstall hook is real but limited to documented creation of a stylelint config file and contains no credential harvesting, network calls, shell execution, or persistence. The package entrypoints are static stylelint configs, so the scanner lifecycle warning is a false positive for maliciousness.

Evidence

package.jsonscripts/postinstall.cjscss/index.cjscss/index.mjsscss/index.cjsscss/index.mjsREADME.md.stylelintrc.json

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

@ivuorinen/stylelint-config@1.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code