registry / hotlane / 0.4.2

hotlane@0.4.2

Validation-first deployment: fork a warm running instance, verify, promote via atomic proxy flip, roll back by pointer.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installation fetches and installs an unverified remote executable. Invoking the CLI executes that fetched binary; its behavior is not present for source review.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; running hotlane invokes the binary.

Impact

A compromised or replaced release artifact could execute arbitrary code as the installing user.

Mechanism

postinstall remote binary download, extraction, and execution shim

Rationale

No concrete malicious behavior is visible in the JavaScript source, but its install-time unverified executable fetch is a real staged-payload risk. Warn rather than block because the endpoint and behavior are package-aligned and no malicious chain is shown.

Evidence

package.jsoninstall.jsbin/hotlane.jsREADME.mdbin/hotlane.tar.gzbin/hotlane

Network endpoints1

github.com/StefanIancu/hotlane/releases/download/v0.4.2/hotlane_${OS}_${ARCH}.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with false-positive risk.

hotlane@0.4.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code