registry / @mexc/shared-utils / 2.0.1

@mexc/shared-utils@2.0.1

dios confirming for bugrap and mexc that this namespace is taken

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Installing the package automatically executes postinstall.js. It collects basic host metadata and creates a confirmation file in the temporary directory; no outbound endpoint is used.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Creates an unconsented local proof artifact containing username and host details.

Mechanism

install-time host metadata collection and temp-file write

Rationale

This is an unsolicited install-time side effect explicitly intended to demonstrate dependency confusion, so it should be warned. The concrete source lacks an exfiltration or payload chain that would justify a publish block.

Evidence

package.jsonpostinstall.jsREADME.mdindex.jssystem temp directory/mexc-confirmation-dios.txt

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json invokes postinstall.js on install.
postinstall.js collects hostname, username, cwd and runtime metadata.
postinstall.js writes the collected metadata to the system temp directory.

@mexc/shared-utils@2.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code