registry / cors-version / 1.0.1

cors-version@1.0.1

Node.js CORS middleware

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed attack surface: the archive contains no executable package entrypoint or lifecycle hook. The declared entrypoint is missing, so importing the package fails rather than executing payload code.

Static reason

No blocking static signals were detected.

Trigger

Attempting to require/import cors-version.

Impact

Package is nonfunctional, with no observed credential access, network activity, persistence, or file mutation.

Mechanism

Missing declared main module; documentation-only archive.

Rationale

Direct inspection found a documentation-only, nonfunctional package with no shipped executable code or lifecycle scripts. The missing entrypoint is a quality/packaging defect, not concrete malicious behavior.

Evidence

package.jsonREADME.mdLICENSE

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hook.
The declared main file lib/index.js is absent; only package.json, README.md, and LICENSE are shipped.
No executable JavaScript, binaries, or install-time source exists in the extracted package.
README.md contains documentation/examples only; its URLs are documentation or badge links.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 Low

LowScripts Present