registry / @zuii/input / 1.0.2

@zuii/input@1.0.2

Composant Inputs de la bibliothèque ZUII.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Postinstall writes package-provided UI assets into a consumer project when applicable. No confirmed exfiltration or remote execution exists.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Creates components/variables/input.vars.css and, for Symfony, template and PHP component files.

Mechanism

Fixed non-overwriting asset copy into detected project paths

Rationale

The install hook mutates consumer projects without an explicit command, creating a real lifecycle risk. Its fixed, package-aligned, non-overwriting copies and absence of exfiltration or execution chains do not establish malicious intent.

Evidence

package.jsondist/eject.jsdist/index.jsdist/input.vars.cssdist/input.html.twigdist/Input.phpcomponents/variables/input.vars.csstemplates/components/Input.html.twigsrc/Twig/Components/Input.php

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

@zuii/input@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code