registry / ayush-story / 1.7.1

ayush-story@1.7.1

Ayush Choudhary's terminal portfolio — an interactive story

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed attack surface is established. The install hook is a package-aligned terminal notification, and the CLI is user-invoked interactive portfolio output.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes `postinstall.js`; running `ayush` or `ayush-story` invokes `cli.js`.

Impact

No source evidence of persistence, exfiltration, remote execution, filesystem mutation, or AI-agent control-surface writes.

Mechanism

ANSI terminal animation and interactive portfolio rendering.

Rationale

Direct inspection shows the lifecycle script only prints an installation animation, while the executable only renders a local terminal story. The scanner signal is explained by the benign postinstall hook and animation timers.

Evidence

package.jsonpostinstall.jscli.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

`package.json` runs `node postinstall.js` during installation.

Evidence against

`postinstall.js` only writes an ANSI/text installation message and delays; it imports no modules and performs no file or network actions.

ayush-story@1.7.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code