@pax2pay/model-banking@0.1.675
Library containing data model types and functions for the Pax2Pay Banking API.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe install hook unconditionally reruns npm with a zero release-age threshold, creating a concrete supply-chain safeguard bypass. The inspected entrypoint is a re-export, and the source does not establish a separate malicious payload or destructive action, so this warrants a warning rather than a block.
Decision evidence
public snapshot- package.json defines an install hook that runs npm installation with the minimum release age set to zero, overriding the configured delay for that install.
- package.json declares the package dependencies that the install hook can resolve.
- The published entrypoint only re-exports the package namespace.
- The prepare hook runs the build script.
Source & flagged code
5 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json defines an install hook that runs npm installation with the minimum release age set to zero, overriding the configured delay for that install.
package.jsonView on unpkg · L40Findings
Affected versions and remediation
This report applies to @pax2pay/model-banking@0.1.675.
See all versions of @pax2pay/model-banking for other recorded verdicts.
- Review the evidence and your use of @pax2pay/model-banking@0.1.675 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.