registry / @tantuui/react / 0.0.9

@tantuui/react@0.0.9

React component library for TantuUI

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time filesystem mutation targets project AI-assistant rule directories when they already exist. No exfiltration or remote execution is established.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install of @tantuui/react@0.0.9

Impact

Adds or updates a TantuUI guidance file in the consuming project and may influence configured coding assistants.

Mechanism

postinstall copies first-party AI context documentation

Rationale

This is a confirmed first-party agent-extension lifecycle action performed automatically at install time, which warrants a warning under policy. Source inspection found no concrete malicious chain.

Evidence

package.jsonscripts/postinstall.jsdocs/implement-tantuui-token-and-component.mddist/index.jsdist/index.cjs.kiro/steering/implement-tantuui-token-and-component.md.cursor/rules/implement-tantuui-token-and-component.md

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

@tantuui/react@0.0.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code