registry  /  @jjlmoya/utils-printing3d  /  1.22.0

@jjlmoya/utils-printing3d@1.22.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The only install-time behavior is copying package-owned CSS assets into a consumer public/styles/lib/printing3d directory. No confirmed malicious attack surface is established.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall
Impact
Creates or overwrites package CSS asset files for the consumer app; no exfiltration or code execution chain found
Mechanism
package-aligned CSS asset copy
Rationale
Static inspection confirms the lifecycle script performs a package-aligned CSS copy and does not contact network endpoints, execute shell commands, harvest data, or mutate AI-agent control surfaces. The scanner lifecycle warning is explained by benign install-time asset setup rather than concrete attack behavior.
Evidence
package.jsonscripts/postinstall.mjssrc/index.tssrc/data.tssrc/entries.tspublic/styles/lib/printing3d/*.css

Decision evidence

public snapshot
AI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for block
  • package.json defines postinstall: node scripts/postinstall.mjs
  • scripts/postinstall.mjs writes copied CSS into consumer public/styles/lib/printing3d when installed under node_modules
Evidence against
  • scripts/postinstall.mjs exits unless running from node_modules and only reads package CSS files
  • No child_process, eval/vm, credential harvesting, destructive commands, or network code found in install script
  • Runtime exports in src/index.ts, src/data.ts, and src/entries.ts are Astro/tool metadata and component loaders
  • Search hits for URLs are schema.org, bibliography links, or font links, not exfiltration endpoints
Behavioral surface
Source
ChildProcessFilesystem
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 218 file(s), 2.40 MB of source, external domains: blog.prusa3d.com, docs.vorondesign.com, e3d-online.com, en.wikipedia.org, formlabs.com, forum.simplify3d.com, github.com, help.prusa3d.com, pubchem.ncbi.nlm.nih.gov, reprap.org, schema.org, sigmafilament.com, wiki.bambulab.com, www.cdc.gov, www.engineeringtoolbox.com, www.hubs.com, www.iso.org, www.matterhackers.com, www.simplify3d.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License