registry / @peers-app/peers-sdk / 0.21.0

@peers-app/peers-sdk@0.21.0

The core SDK for building [Peers](https://peers.app) packages.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

The SDK is a package-runtime framework that evaluates stored JavaScript bundles. In Node, evaluated bundles can access ordinary Node modules through a permissive require bridge.

Static reason

No blocking static signals were detected.

Trigger

Creating/loading a user context with active packages, or explicitly calling package clone/install APIs.

Impact

A malicious or tampered active package bundle can execute code in the host process; cloning an untrusted repository can execute its npm lifecycle/build code.

Mechanism

Dynamic bundle evaluation and caller-supplied repository installation.

Rationale

Source inspection found no covert install hook, exfiltration, persistence, or destructive behavior. The dynamic execution and remote-repository installation primitives create a concrete, unresolved host-code-execution risk and warrant a warning rather than a block.

Evidence

dist/package-loader/package-loader.jsdist/context/user-context.jsdist/package-installer/package-cloner.jsdist/package-installer/package-propagation.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

@peers-app/peers-sdk@0.21.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code