registry / ansi-tint / 1.4.6

ansi-tint@1.4.6

Zero-dependency ANSI color helpers for terminal output.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package creates a file in the consuming project without user consent. The package disguises this mutation as an ANSI formatting helper.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, which invokes postinstall

Impact

Unexpected modification of the consumer project and reviewer-directed social engineering.

Mechanism

install hook writes a crafted file to the consumer project

Attack narrative

The manifest runs scripts/setup.js automatically after installation. That script selects INIT_CWD or the current directory and writes hacked.txt there. Its content claims the repository did not create the file and instructs the recipient to investigate install hooks, making the mutation intentional rather than required package setup.

AI rationale

This package has no legitimate need to modify a consumer project to provide ANSI formatting. The automatic, deceptive postinstall write is concrete install-hook abuse.

Evidence

package.jsonscripts/setup.jshacked.txt

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Its postinstall hook automatically runs a setup script.

ansi-tint@1.4.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code