@relyon/store-kit@0.1.6
Relyon Core: run npx @relyon/store-kit@latest init first, then read relyon/QUICKSTART.md. Payments and agent commerce on your own domain.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged postinstall hook only prints guidance and reads no project or environment data. Network and filesystem behavior is tied to the package's setup and diagnostics, with sandbox provisioning performed through the Relyon API during an explicit init command.
Decision evidence
public snapshot- The postinstall hook requires only scripts/install-notice.cjs.
- The install notice says it reads no project or environment data and only writes setup guidance to stdout.
- The CLI dispatches init only when the parsed command is init.
- Sandbox provisioning posts to the package's Relyon API during init.
- The package has a postinstall lifecycle script.
- The package includes filesystem and network behavior for setup and store diagnostics.
Source & flagged code
5 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook requires only scripts/install-notice.cjs.
package.jsonView on unpkg · L75Findings
Affected versions and remediation
This report applies to @relyon/store-kit@0.1.6.
See all versions of @relyon/store-kit for other recorded verdicts.
- Review the evidence and your use of @relyon/store-kit@0.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.