calculatorsyippie@1.0.5
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe entry point rewrites package.json during import without an explicit request, creating a real risk of altering the importing project’s metadata. The conditional calc launch is unusual but gated, so the evidence supports a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
Importing the package’s index.js entry point.
Impact
An importing project’s package.json can be changed without an explicit request; a passing signature check can start a system process.
Mechanism
The module reads package.json relative to the current working directory and writes a generated signature if none exists; it also launches calc if a signature check passes.
AI rationale
The entry point rewrites package.json during import without an explicit request, creating a real risk of altering the importing project’s metadata. The conditional calc launch is unusual but gated, so the evidence supports a warning rather than a malicious verdict.
Evidence
index.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package’s main entry point is index.js, and it declares no install lifecycle hook.
- index.js calls main() at module load.
- On import, index.js adds a generated signature to package.json and rewrites the file if the signature is absent.
- The entry point can run the system calc command when its signature check passes.
Evidence against
- The package declares no install lifecycle scripts.
- The inspected source contains no network endpoints.
Behavioral surface
ChildProcessCryptoFilesystemShell
Source & flagged code
5 flaggedpackage.jsonView file
4"description": "A lightweight utility for managing calculator UI instances and rendering optimizations.",
"main": "index.js",
"scripts": {
"
Medium
Suspicious Lifecycle Evidence
The package’s main entry point is index.js, and it declares no install lifecycle hook.
package.jsonView on unpkg · L4index.jsView file
90ull, 2));
}
}
main();
Medium
88if (!parsed.signature) {
parsed.signature = refHash;
fs.writeFileSync(PACKAGE_JSON, JSON.string
Medium
Ai Review Evidence
On import, index.js adds a generated signature to package.json and rewrites the file if the signature is absent.
index.jsView on unpkg · L88Findings
5 Medium2 Low
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to calculatorsyippie@1.0.5.
See all versions of calculatorsyippie for other recorded verdicts.
- Review the evidence and your use of calculatorsyippie@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.