registry  /  isotropic-dev-dependencies  /  0.9.0

isotropic-dev-dependencies@0.9.0

Common development dependencies used by Isotropic

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The prepare script can modify a local Git pre-commit hook when run in a repository. No confirmed network or credential-exfiltration attack surface exists.

Static reason
No blocking static signals were detected.
Trigger
Running the package's `prepare` script in a directory containing `.git`.
Impact
Can block commits whose configured author is absent from project metadata.
Mechanism
Prepare-time Git hook installation and local committer validation.
Rationale
Source inspection found a real prepare-time Git hook mutation, which warrants a warning under the install-control-surface policy. The implementation is narrowly scoped and lacks concrete malicious behavior.
Evidence
package.jsonlib/install-git-hooks.jslib/validate-committer.jsREADME.md.git/hooks/pre-commit

Decision evidence

public snapshot
AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `package.json` defines a `prepare` lifecycle hook.
  • `lib/install-git-hooks.js` writes and chmods `.git/hooks/pre-commit`.
  • The hook executes `lib/validate-committer.js` before commits.
Evidence against
  • Hook setup is limited to an existing `.git` directory.
  • Validation reads only Git author environment values and `package.json` metadata.
  • No network, shell execution, dynamic loading, or credential exfiltration found.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 5 file(s), 2.17 KB of source

Source & flagged code

3 flagged · loading source
package.jsonView file
•Published source reference
Medium
Suspicious Lifecycle Evidence

`package.json` defines a `prepare` lifecycle hook.

package.jsonView on unpkg
lib/install-git-hooks.jsView file
•Published source reference
Medium
Ai Review Evidence

`lib/install-git-hooks.js` writes and chmods `.git/hooks/pre-commit`.

lib/install-git-hooks.jsView on unpkg
lib/validate-committer.jsView file
•Published source reference
Medium
Ai Review Evidence

The hook executes `lib/validate-committer.js` before commits.

lib/validate-committer.jsView on unpkg

Findings

3 Medium2 Low
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencelib/install-git-hooks.js
MediumAi Review Evidencelib/validate-committer.js
LowNon Install Lifecycle Scripts
LowScripts Present