registry / hotlane / 0.3.0

hotlane@0.3.0

Validation-first deployment: fork a warm running instance, verify, promote via atomic proxy flip, roll back by pointer.

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Installation fetches an unverified executable archive and extracts it into the package. Later CLI use executes that binary.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; invoking hotlane executes the fetched binary.

Impact

A compromised or substituted release asset can execute code as the installing user when the CLI is invoked.

Mechanism

unverified remote binary download, extraction, and execution

Rationale

The package is a transparent binary wrapper, but its unverified install-time executable fetch leaves a concrete staged-payload attack surface. Source inspection does not establish active malicious intent.

Evidence

package.jsoninstall.jsbin/hotlane.jsREADME.mdbin/hotlane.tar.gzbin/hotlane

Network endpoints1

github.com/StefanIancu/hotlane/releases/download/v0.3.0/hotlane_${OS}_${ARCH}.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

hotlane@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code