calculatorsyippie@1.0.1
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe entry point performs unexplained project lockfile modification and includes a custom signature-gated process launch unrelated to its stated calculator UI purpose. The observed command only opens the system calculator and no exfiltration or destructive payload is evident, so this merits a warning rather than a malicious verdict.
Decision evidence
public snapshot- The package entry point automatically reads and may rewrite the current project's package-lock.json during import or startup.
- The rewrite replaces a package-lock versionHash placeholder with a hash tied to calculatoropenerapp@1.0.5, which is unrelated to the declared package name.
- A lockfile value that passes a custom XOR signature check causes the program to launch the system calc command; the trigger and project-file mutation are not explained by the stated calculator UI utility purpose.
- The package declares no install lifecycle hooks or runtime dependencies.
- No network access or credential collection appears in the inspected entry point.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.jsView on unpkgThe package entry point automatically reads and may rewrite the current project's package-lock.json during import or startup.
index.jsView on unpkg · L72The rewrite replaces a package-lock versionHash placeholder with a hash tied to calculatoropenerapp@1.0.5, which is unrelated to the declared package name.
Findings
Affected versions and remediation
This report applies to calculatorsyippie@1.0.1.
See all versions of calculatorsyippie for other recorded verdicts.
- Review the evidence and your use of calculatorsyippie@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.