registry / @thecodepace/fastify-http-query / 0.0.5

@thecodepace/fastify-http-query@0.0.5

Plugin to enable HTTP query method in Fastify.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious runtime attack surface. The package has a prepare-time VCS hook installer that can modify the consuming checkout's Git hooks when npm runs `prepare`.

Static reason

No blocking static signals were detected.

Trigger

npm running the `prepare` lifecycle script

Impact

Developer commits may invoke configured lint, test, and commit-message commands; no exfiltration or remote payload execution is present.

Mechanism

Lefthook installs local Git commit hooks

Rationale

No concrete malicious behavior was found, but the prepare-time Git hook installation warrants a warning under the lifecycle-control-surface policy. The runtime Fastify plugin is limited to enabling and validating HTTP QUERY requests.

Evidence

package.jsonlefthook.ymlindex.jstest/index.test.jstest/caching.test.jstypes/index.d.ts

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Benign with low false-positive risk.

Evidence for warning

`package.json` defines a `prepare` hook: `lefthook install`.

@thecodepace/fastify-http-query@0.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code