registry / meet-ayush / 1.7.1

meet-ayush@1.7.1

Ayush Choudhary's terminal portfolio — an interactive story

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook emits terminal animation only, and the CLI handles local terminal input/output.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall or explicit `meet-ayush` CLI invocation

Impact

No observed data access, network activity, code execution, persistence, or mutation beyond terminal output.

Mechanism

Terminal-only portfolio rendering with `readline` and ANSI output

Rationale

The lifecycle script is a benign stdout-only animation, which explains the scanner signal. Direct inspection of all shipped source found no concrete malicious behavior.

Evidence

package.jsonpostinstall.jscli.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

`package.json` defines `postinstall: node postinstall.js`.

Evidence against

`postinstall.js` only uses stdout, timers, and TTY detection to render install text.
`cli.js` imports only Node's `readline` and renders a local interactive terminal portfolio.
No filesystem, environment, network, subprocess, dynamic-code, or native-loading APIs appear in shipped JS.
No endpoints, credential collection, persistence, destructive actions, or AI-agent configuration writes were found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 45.8 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-29json

2 "name": "meet-ayush",

3 "version": "1.7.1",

4 "description": "Ayush Choudhary's terminal portfolio — an interactive story",

5 "bin": {

6 "meet-ayush": "cli.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "files": [

12 "cli.js",

13 "postinstall.js",

14 "README.md"

15 ],

16 "keywords": [

17 "portfolio",

18 "cli",

19 "ayush",

20 "meet",

21 "story",

22 "terminal"

23 ],

24 "author": "Ayush Choudhary <choudharyayush891@gmail.com>",

25 "license": "MIT",

26 "preferGlobal": true,

27 "engines": {

28 "node": ">=16"

29 }

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowHigh Entropy Strings