Loading npm security reports…

@jjlmoya/utils-home@1.37.0: Clean npm security report (Allow) | LPM Firewall

registry / @jjlmoya/utils-home / 1.37.0

@jjlmoya/utils-home@1.37.0

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook performs a package-aligned CSS asset copy for host project styling when installed under node_modules.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install/postinstall

Impact

Creates or overwrites package CSS asset files in the consuming project public styles directory; no evidence of exfiltration, persistence, or code execution beyond file copy.

Mechanism

copies packaged CSS assets into public/styles/lib/home

Rationale

The only install-time behavior is a transparent CSS copy from the package into a predictable public styles directory, with no network, shell, credential, or obfuscated payload behavior found. Other inspected entrypoints are content/tool exports for an Astro utility package, so the scanner lifecycle warning is a false positive for maliciousness.

Evidence

package.jsonscripts/postinstall.mjsscripts/fix_ru.mjssrc/index.tssrc/data.tssrc/entries.tssrc/tools.tspublic/styles/lib/home/*.css

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall: node scripts/postinstall.mjs
scripts/postinstall.mjs runs only under node_modules and copies packaged tool CSS into project public/styles/lib/home
scripts/fix_ru.mjs can rewrite a caller-supplied file, but it is not a lifecycle hook or exported entrypoint

Evidence against

scripts/postinstall.mjs reads package.json and src/tool CSS files only; no shell execution or network
src/index.ts, src/data.ts, src/entries.ts, and src/tools.ts are static exports/dynamic component loaders
rg found no credential harvesting, process.env use, fetch/XHR/WebSocket, child_process, eval, or native binary loading in runtime/lifecycle paths
Network strings are bibliography/schema/font/example URLs in content or Astro preview pages, not exfiltration endpoints

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

2 flagged

package.jsonView file

Lines 14-54json

14 "scripts"

15 ],

16 "publishConfig": {

17 "access": "public"

18 },

19 "scripts": {

20 "dev": "astro dev",

21 "start": "astro dev",

22 "build": "astro build",

23 "preview": "astro preview",

24 "astro": "astro",

25 "lint": "eslint src/ --max-warnings 0 && stylelint \"src/**/*.{css,astro}\"",

26 "check": "astro check",

27 "type-check": "astro check",

28 "test": "vitest run",

29 "preversion": "npm run lint && npm run test",

30 "postversion": "git push && git push --tags",

31 "patch": "npm version patch",

32 "minor": "npm version minor",

33 "major": "npm version major",

34 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "lint-staged": {

37 "*.{ts,tsx,astro}": [

38 "eslint --fix"

39 ]

40 },

41 "dependencies": {

42 "@iconify-json/mdi": "^1.2.3",

43 "@jjlmoya/prompagate": "^1.1.0",

44 "@jjlmoya/utils-shared": "1.2.0",

45 "astro": "^6.1.2",

46 "astro-icon": "^1.1.0",

47 "jspdf": "^4.2.1",

48 "qrcode": "^1.5.4"

49 },

50 "devDependencies": {

51 "@astrojs/check": "^0.9.8",

52 "@types/qrcode": "^1.5.6",

53 "eslint": "^9.39.4",

54 "eslint-plugin-astro": "^1.6.0",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License