registry / @patchstack/connect / 0.5.0

@patchstack/connect@0.5.0

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

An explicit CLI setup command modifies the consumer project's lifecycle scripts. Those scripts can subsequently scan dependencies and report a manifest to Patchstack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The user runs patchstack-connect setup in a project.

Impact

Future dependency installs and builds can run Patchstack commands and disclose dependency inventory data to the configured Patchstack endpoint.

Mechanism

User-invoked lifecycle-hook installation and manifest reporting.

AI rationale

The package is not malicious on the inspected evidence because it lacks an automatic registry install hook and its metadata-address handling is defensive. It remains suspicious because its explicit setup command persistently alters consumer lifecycle scripts and enables recurring network reporting.

Evidence

dist/cli.jsdist/index.cjspackage.json.patchstackrc.json.patchstackrc.local.json.gitignore

Network endpoints1

api.patchstack.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence with false-positive risk.

@patchstack/connect@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code