registry / irises / 1.0.42

irises@1.0.42

模块化、可解耦的 AI 聊天框架，支持多平台、多 LLM、工具调用

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook performs package-local binary setup only.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs postinstall; invoking iris launches the selected binary.

Impact

Creates executable cache links under this package's bin directory.

Mechanism

Package-local linking/copying and user-invoked binary launcher.

Rationale

The lifecycle hook is a package-aligned setup step for declared platform dependencies and modifies only its own bin directory. Source inspection found no concrete malicious behavior.

Evidence

package.jsonpostinstall.mjsbin/irisbin/.irisbin/.iris-onboard

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines a postinstall hook.
postinstall.mjs links/copies platform binaries into bin/.iris and bin/.iris-onboard.

Evidence against

postinstall.mjs only resolves declared irises-<platform>-<arch> optional dependencies.
No network, credential harvesting, shell execution, eval, or agent-config writes found.
bin/iris only launches a resolved platform binary when the user runs iris.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

Manifest

CopyleftLicense

scanned 1 file(s), 2.93 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-19json

2 "name": "irises",

3 "version": "1.0.42",

4 "description": "模块化、可解耦的 AI 聊天框架，支持多平台、多 LLM、工具调用",

5 "license": "GPL-3.0-only",

6 "bin": {

7 "iris": "./bin/iris"

8 },

9 "scripts": {

10 "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "optionalDependencies": {

13 "irises-linux-x64": "1.0.42",

14 "irises-darwin-arm64": "1.0.42",

15 "irises-windows-x64": "1.0.42",

16 "irises-linux-arm64": "1.0.42",

17 "irises-darwin-x64": "1.0.42"

18 }

19}

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = bun ./postinstall.mjs || node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun ./postinstall.mjs || node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowFilesystem

LowCopyleft License