registry / @materialui-reactjs/admin / 1.0.4

@materialui-reactjs/admin@1.0.4

Reusable React admin components

AI Security Review

scanned 6d ago · by lpm-firewall-ai

npm install triggers an unconsented mutation of the consuming project's manifest. The script may create package.json, then asynchronously adds all peer dependencies.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Unexpected dependency-manifest changes and supply-chain risk in the consuming project

Mechanism

detached Node child rewrites consumer package.json

Rationale

The install hook silently mutates a foreign project manifest and hides its activity in a delayed detached process. It is unsafe behavior, but does not meet the stated block threshold because no concrete malicious chain or AI-agent control-surface mutation was found.

Evidence

package.jsonscripts/postinstall.cjsdist/utils/index.jsdist/chunks/Env-DRXhvUcb.js<consumer-project>/package.json

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs postinstall
scripts/postinstall.cjs resolves consumer project root
postinstall creates or rewrites consumer package.json

@materialui-reactjs/admin@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code