Loading npm security reports…

@jjlmoya/utils-home: Clean npm security report (Allow) | LPM Firewall

registry / @jjlmoya/utils-home / 1.39.0

@jjlmoya/utils-home@1.39.0

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The postinstall hook copies bundled CSS assets into the consuming project's public styles directory.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install executes postinstall when installed under node_modules

Impact

Creates or overwrites CSS files under public/styles/lib/home; no exfiltration or remote execution observed

Mechanism

Copies local package CSS assets to a package-aligned project directory

Rationale

The install hook performs a visible, package-aligned CSS asset copy and contains no network, shell, credential, remote-payload, or AI-agent-control behavior. Static scanner concern is attributable to the lifecycle hook rather than a malicious chain.

Evidence

package.jsonscripts/postinstall.mjssrc/index.tssrc/tools.tsscripts/fix_ru.mjssrc/toolpublic/styles/lib/home

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall.
scripts/postinstall.mjs runs during npm install from node_modules.
It writes package CSS into public/styles/lib/home/ in the consuming project.

Evidence against

Postinstall reads only its package manifest and src/tool directories.
Lifecycle code copies only .css files; it has no network or shell execution.
No credential, agent-config, environment-harvesting, eval, or child-process use was found in scripts or runtime source.
External URLs in source are bibliography/QR data, not network calls.

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 393 file(s), 2.63 MB of source, external domains: beispiel.de, community.wmo.int, comparador.cnmc.gob.es, contoh.com, ejemplo.com, energy-efficient-products.ec.europa.eu, energysavingtrust.org.uk, epson.com, ergo.human.cornell.edu, es.scribd.com, esempio.it, example.com, example.jp, exempel.se, exemple.com, exemplo.pt, github.com, knowledge.bsigroup.com, learningnetwork.cisco.com, ornek.com, primer.ru, przyklad.pl, pvwatts.nrel.gov, re.jrc.ec.europa.eu, schema.org, standards.ieee.org, standby.lbl.gov, tcnatile.com, voorbeeld.nl, wqa.org, www.ashrae.org, www.benjaminmoore.com, www.benq.com, www.boe.es, www.carrier.com, www.ctdahome.org, www.dulux.co.uk, www.energy.gov, www.energystar.gov, www.epa.gov, www.esios.ree.es, www.hydroquebec.com, www.idae.es, www.iso.org, www.miteco.gob.es, www.ocu.org, www.omie.es, www.osha.gov, www.projectorcentral.com, www.researchgate.net

Source & flagged code

2 flagged

package.jsonView file

Lines 16-56json

16 "scripts"

17 ],

18 "publishConfig": {

19 "access": "public"

20 },

21 "scripts": {

22 "dev": "astro dev",

23 "start": "astro dev",

24 "build": "astro build",

25 "preview": "astro preview",

26 "astro": "astro",

27 "lint": "eslint src/ --max-warnings 0 && stylelint \"src/**/*.{css,astro}\"",

28 "check": "astro check",

29 "type-check": "astro check",

30 "test": "vitest run",

31 "preversion": "npm run lint && npm run test",

32 "postversion": "git push && git push --tags",

33 "patch": "npm version patch",

34 "minor": "npm version minor",

35 "major": "npm version major",

36 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 },

38 "lint-staged": {

39 "*.{ts,tsx,astro}": [

40 "eslint --fix"

41 ]

42 },

43 "dependencies": {

44 "@iconify-json/mdi": "^1.2.3",

45 "@jjlmoya/prompagate": "^1.1.0",

46 "@jjlmoya/utils-shared": "1.2.0",

47 "astro": "^6.1.2",

48 "astro-icon": "^1.1.0",

49 "jspdf": "^4.2.1",

50 "qrcode": "^1.5.4"

51 },

52 "devDependencies": {

53 "@astrojs/check": "^0.9.8",

54 "@types/qrcode": "^1.5.6",

55 "eslint": "^9.39.4",

56 "eslint-plugin-astro": "^1.6.0",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License