registry / @patchstack/connect / 0.5.6

@patchstack/connect@0.5.6

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Run the patchstack-connect setup or scan CLI command.

Impact

Future dependency installs and builds can transmit project dependency and deployment metadata.

Mechanism

Agent-directed setup installs lifecycle hooks and posts manifests to a vendor API.

AI rationale

This is an explicit-command, broad consumer-project mutation and reporting capability paired with reviewer and agent social engineering. It lacks an automatic registry-install hook, so the evidence does not establish an unconsented install-time attack.

Evidence

README.mddist/cli.jsdist/index.cjspackage.json.patchstackrc.json.patchstackrc.local.json.gitignore

Network endpoints1

api.patchstack.com

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence with false-positive risk.

@patchstack/connect@0.5.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code