@pax2pay/model-banking@0.1.677
Library containing data model types and functions for the Pax2Pay Banking API.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe install hook performs an unexplained nested package installation, which creates unresolved install-time risk. The inspected runtime code is consistent with a caller-configured banking API client, and no separate concrete attack was established.
Decision evidence
public snapshot- The package's unconditional install hook starts another npm install in the consumer's project.
- The separate prepare hook runs the package build.
- The runtime client uses a caller-supplied server and key; the inspected login method sends credentials through that client.
- The inspected runtime paths show API client behavior, and the search found no child_process use or additional HTTPS endpoints in dist/mjs.
Source & flagged code
6 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package's unconditional install hook starts another npm install in the consumer's project.
package.jsonView on unpkg · L43Findings
Affected versions and remediation
This report applies to @pax2pay/model-banking@0.1.677.
See all versions of @pax2pay/model-banking for other recorded verdicts.
- Review the evidence and your use of @pax2pay/model-banking@0.1.677 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.