registry / pi-usereq / 0.50.0

pi-usereq@0.50.0

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Installation silently weakens the consumer project's lifecycle-script approval policy. It can approve arbitrary installed dependencies' lifecycle scripts without user confirmation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation of pi-usereq

Impact

Later dependency lifecycle hooks may execute under an approval policy the user did not grant.

Mechanism

postinstall auto-approves dependency lifecycle scripts and runs npm installs

AI rationale

Source inspection confirms a concrete unconsented install-time policy mutation, but not credential theft, payload staging, or AI-agent control-surface hijacking. This is a dangerous install-hook abuse risk warranting warning rather than a block.

Evidence

package.jsonscripts/install-static-checkers.tssrc/core/config.tssrc/core/pi-notify.ts<npm_config_local_prefix>/package.json<installation-root>/node_modules

Network endpoints1

api.pushover.net/1/messages.json

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence with false-positive risk.

pi-usereq@0.50.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code