registry / @ivuorinen/stylelint-config / 1.3.0

@ivuorinen/stylelint-config@1.3.0

ivuorinen's shareable configuration for stylelint.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The install hook creates a missing `.stylelintrc.json` in the invoking project. This is a documented, package-aligned configuration bootstrap; no malicious attack surface is confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install executes postinstall

Impact

Creates a single non-secret configuration file only when no stylelint config is found.

Mechanism

conditional local stylelint config creation

Rationale

The postinstall hook is transparent and limited to bootstrapping the package's documented stylelint configuration. Source inspection found no exfiltration, remote execution, persistence, destructive behavior, or AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.cjsREADME.mdcss/index.cjsscss/index.cjs.stylelintrc.jsoncss/index.mjsscss/index.mjs

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json runs postinstall
scripts/postinstall.cjs writes .stylelintrc.json when absent

@ivuorinen/stylelint-config@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code