registry / @stackfactor/client-api / 1.1.252

@stackfactor/client-api@1.1.252

Node.js library for the StackFactor API

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a StackFactor API client with user-invoked HTTP and websocket operations; suspicious signals are package-aligned or build-time only.

Static reason

One or more suspicious static signals were detected.

Trigger

import or explicit API method call by the consuming application

Impact

No confirmed unauthorized execution, persistence, exfiltration, or destructive behavior

Mechanism

StackFactor API client wrappers using axios/socket.io

Rationale

Static inspection found a normal generated API client; network use is directed at StackFactor endpoints or explicit user-supplied content URLs, and lifecycle scripts do not run on consumer install. The builtin-name latest dependency and dotenv import-time .env read are quality/supply-chain concerns but do not show malicious behavior in this package source.

Evidence

package.jsondist/esm/lib/index.jsdist/esm/lib/axiosClient.jsdist/esm/lib/utils.jsdist/esm/lib/integration.js.envdist/esm/package.jsondist/cjs/package.json

Network endpoints6

localhostqaapi.stackfactor.aiapiqa.stackfactor.aiapi.stackfactor.ai

@stackfactor/client-api@1.1.252

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code