create-multimorphism@1.1.3
Ready-made React layout template for frontend developers and designers featuring 14 trending design styles including Claymorphism and Neo-Brutalism.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe postinstall hook only prints a notice, and runtime telemetry requires confirmation. However, the prompt describes anonymous usage data while the opted-in collection also sends IP and optional identifying details, making the disclosure insufficient; classify this as suspicious telemetry.
Decision evidence
public snapshot- The CLI describes the opt-in as sharing anonymous usage data and defaults the confirmation to false.
- After confirmation, it asks for the user's name, email address, and project purpose.
- The event includes the project name, IP address, name, email, and purpose, then posts to Google Analytics.
- The postinstall script only prints a notice recommending use through npm create.
- The telemetry function returns without collecting or sending data unless the user confirms.
Source & flagged code
7 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to create-multimorphism@1.1.3.
See all versions of create-multimorphism for other recorded verdicts.
- Review the evidence and your use of create-multimorphism@1.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.