files.com@1.2.731
Files.com SDK for JavaScript
AI Security Review
scanned 2d ago · by lpm-firewall-aiThis version is suspicious because its shipped build helper silently deletes npm and Yarn configuration files when run. The helper is not an install hook or part of the manifest's normal build command, so the evidence supports a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
A user or build process explicitly runs build.sh.
Impact
Registry settings and credentials stored in those configuration files may be lost.
Mechanism
The script runs rm -f on ~/.npmrc and ~/.yarnrc before installing dependencies and building.
AI rationale
This version is suspicious because its shipped build helper silently deletes npm and Yarn configuration files when run. The helper is not an install hook or part of the manifest's normal build command, so the evidence supports a warning rather than a malicious verdict.
Evidence
build.sh~/.npmrc~/.yarnrc
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- build.sh unconditionally removes ~/.npmrc and ~/.yarnrc before running npm install and the build.
- The manifest’s build script runs Babel directly; it does not invoke build.sh, and there are no lifecycle scripts.
- The SDK sends its configured API key on requests to the configured Files.com service.
Evidence against
- The destructive helper is not configured to run automatically during installation or by the manifest’s normal build script.
- The CLI wrapper locates and executes files-cli; it contains no download or collection logic.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
lib/models/AutomationLog.js
Source & flagged code
6 flaggedbuild.shView file
•path = build.sh
kind = build_helper
sizeBytes = 102
magicHex = [redacted]
Medium
3rm -f ~/.npmrc
rm -f ~/.yarnrc
npm install --min-release-age=14 && npm run b
Medium
Ai Review Evidence
build.sh unconditionally removes ~/.npmrc and ~/.yarnrc before running npm install and the build.
build.shView on unpkg · L3lib/models/AutomationLog.jsView file
•path = lib/models/AutomationLog.js
kind = oversized_source_file
sizeBytes = 4629142
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
lib/models/AutomationLog.jsView on unpkgFindings
1 Critical1 High6 Medium4 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedbin/files-cli-ai
MediumNetwork
MediumShips Build Helperbuild.sh
MediumOversized Source Filelib/models/AutomationLog.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencebuild.sh
MediumAi Review Evidencesrc/Api.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to files.com@1.2.731.
See all versions of files.com for other recorded verdicts.
- Review the evidence and your use of files.com@1.2.731 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.