registry / @mexc/shared-utils / 3.0.0

@mexc/shared-utils@3.0.0

dios confirming for bugrap and mexc that this namespace is taken

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Installation executes a dependency-confusion proof script without a user command. It collects limited host metadata and writes it to a temporary file; no network transmission is implemented.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

Unconsented install-time local execution and temp-file mutation; no confirmed exfiltration or persistence.

Mechanism

postinstall host-metadata collection and temporary proof-file write

Rationale

This is an intentional dependency-confusion PoC with unconsented install-time local execution, but the inspected source shows only bounded local proof behavior and no concrete exfiltration or destructive chain.

Evidence

package.jsonpostinstall.jsREADME.mdindex.js<system temp>/mexc-confirmation-dios.txt

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs postinstall.js automatically on install.
postinstall.js collects hostname, username, cwd, platform, and Node version.

@mexc/shared-utils@3.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code