Loading npm security reports…

@jjlmoya/utils-home@1.38.0: Clean npm security report (Allow) | LPM Firewall

registry / @jjlmoya/utils-home / 1.38.0

@jjlmoya/utils-home@1.38.0

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook performs a package-aligned asset-copy operation only when installed as a dependency.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install in a project consuming the package

Impact

Creates/updates copied CSS assets under the consuming project public directory; no exfiltration or code execution beyond the declared script observed.

Mechanism

postinstall CSS asset copy

Rationale

Direct source inspection found a lifecycle script, but it only reads package CSS files and writes them to a project public styles directory for the home utilities package. I found no install/import-time network access, credential collection, shell execution, persistence, destructive behavior, or AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjssrc/index.tssrc/data.tssrc/entries.tssrc/tools.tssrc/tool/qrGenerator/component.astropublic/styles/lib/home/*.css

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json has install-time postinstall hook: node scripts/postinstall.mjs

Evidence against

scripts/postinstall.mjs exits unless installed under node_modules
postinstall only copies packaged CSS from src/tool/* into public/styles/lib/home
No child_process/eval/credential harvesting found in inspected lifecycle and entrypoints
src/index.ts, src/data.ts, src/entries.ts, src/tools.ts export Astro/tool definitions
Network URLs are bibliography/schema/font/example links, not install-time endpoints

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 392 file(s), 2.62 MB of source, external domains: beispiel.de, community.wmo.int, comparador.cnmc.gob.es, contoh.com, ejemplo.com, energy-efficient-products.ec.europa.eu, energysavingtrust.org.uk, epson.com, ergo.human.cornell.edu, es.scribd.com, esempio.it, example.com, example.jp, exempel.se, exemple.com, exemplo.pt, github.com, knowledge.bsigroup.com, learningnetwork.cisco.com, ornek.com, primer.ru, przyklad.pl, pvwatts.nrel.gov, re.jrc.ec.europa.eu, schema.org, standards.ieee.org, standby.lbl.gov, tcnatile.com, voorbeeld.nl, wqa.org, www.ashrae.org, www.benjaminmoore.com, www.benq.com, www.boe.es, www.carrier.com, www.ctdahome.org, www.dulux.co.uk, www.energy.gov, www.energystar.gov, www.epa.gov, www.esios.ree.es, www.hydroquebec.com, www.idae.es, www.iso.org, www.miteco.gob.es, www.ocu.org, www.omie.es, www.osha.gov, www.projectorcentral.com, www.researchgate.net

Source & flagged code

2 flagged

package.jsonView file

Lines 14-54json

14 "scripts"

15 ],

16 "publishConfig": {

17 "access": "public"

18 },

19 "scripts": {

20 "dev": "astro dev",

21 "start": "astro dev",

22 "build": "astro build",

23 "preview": "astro preview",

24 "astro": "astro",

25 "lint": "eslint src/ --max-warnings 0 && stylelint \"src/**/*.{css,astro}\"",

26 "check": "astro check",

27 "type-check": "astro check",

28 "test": "vitest run",

29 "preversion": "npm run lint && npm run test",

30 "postversion": "git push && git push --tags",

31 "patch": "npm version patch",

32 "minor": "npm version minor",

33 "major": "npm version major",

34 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "lint-staged": {

37 "*.{ts,tsx,astro}": [

38 "eslint --fix"

39 ]

40 },

41 "dependencies": {

42 "@iconify-json/mdi": "^1.2.3",

43 "@jjlmoya/prompagate": "^1.1.0",

44 "@jjlmoya/utils-shared": "1.2.0",

45 "astro": "^6.1.2",

46 "astro-icon": "^1.1.0",

47 "jspdf": "^4.2.1",

48 "qrcode": "^1.5.4"

49 },

50 "devDependencies": {

51 "@astrojs/check": "^0.9.8",

52 "@types/qrcode": "^1.5.6",

53 "eslint": "^9.39.4",

54 "eslint-plugin-astro": "^1.6.0",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License