my-postinstall-pkg
A package that runs a postinstall script
This report shows the evidence for my-postinstall-pkg@1.0.16, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe lifecycle hook performs concrete, unconsented harvesting of a user-owned shell configuration file and writes it outside the package. Absence of network exfiltration does not make the install-time local disclosure benign.
Decision evidence
public snapshot- `package.json` runs `scripts/postinstall.sh` during install.
- `scripts/postinstall.sh` reads `$HOME/.bashrc` (with a fixed-home fallback).
- The hook writes the copied shell configuration into `$INIT_CWD/postinstall-notice.txt`.
- Bundled `postinstall-notice.txt` demonstrates captured `.bashrc` content.
- No network command or external endpoint appears in the inspected package files.
- No remote payload loading, shell-profile modification, or destructive command was found.
Source & flagged code
3 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage ships non-JavaScript build or shell helper files.
scripts/postinstall.shView on unpkgFindings
Affected versions and remediation
This report applies to my-postinstall-pkg@1.0.16.
The versions list below shows the verdict for each recorded version.
- Avoid installing my-postinstall-pkg@1.0.16. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.