registry / pi-usereq / 0.60.0

pi-usereq@0.60.0

AI Security Review

scanned 6h ago · by lpm-firewall-ai

The postinstall hook can modify the installing project's package.json by approving lifecycle scripts for installed dependencies. This weakens the consumer's script approval gate without an explicit user command.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm runs the package's postinstall lifecycle hook.

Impact

Dependencies that previously lacked approval can receive persistent permission to run install scripts, including after dependency version changes.

Mechanism

The hook scans node_modules for packages with install lifecycle scripts, adds missing package names to allowScripts as true, and writes the merged map to the consumer package.json.

AI rationale

The automatic postinstall mutation of the consumer's script-approval policy is a concrete unresolved install-time risk, so this warrants a warning. The inspected notification code sends configured data only to the fixed Pushover endpoint and does not establish a separate malicious attack.

Evidence

package.jsonscripts/install-static-checkers.tsconsumer package.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script during installation.

pi-usereq@0.60.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code