registry / hotlane / 0.2.0

hotlane@0.2.0

Validation-first deployment: fork a warm running instance, verify, promote via atomic proxy flip, roll back by pointer.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Postinstall fetches an opaque native binary from GitHub Releases, extracts it into bin/, and marks it executable. The wrapper later runs that uninspectable binary.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs postinstall; invoking hotlane runs the fetched binary.

Impact

A compromised or substituted release artifact can execute arbitrary code under the installing user's privileges.

Mechanism

install-time remote binary staging and later execution

Rationale

The visible JavaScript does not show direct malicious behavior, but it stages an unverified remote executable at install time and delegates all runtime behavior to it. This is an unresolved staged-payload risk rather than proof of malicious intent.

Evidence

package.jsoninstall.jsbin/hotlane.jsREADME.mdbin/hotlane.tar.gzbin/hotlane

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

hotlane@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code