pit-js@5.1.1
Pollable Input
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe preinstall script mutates Git configuration and can disrupt the enclosing repository's hooks. This presents a concrete install-time risk, though the package's runtime code appears aligned with an input library and the source does not establish malicious intent.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation when the lifecycle command can run inside a Git worktree.
Impact
Existing repository hooks may stop running if that path is absent.
Mechanism
The preinstall script invokes `git config core.hooksPath git_hooks`, redirecting Git to the package's `git_hooks` path.
AI rationale
The preinstall script mutates Git configuration and can disrupt the enclosing repository's hooks. This presents a concrete install-time risk, though the package's runtime code appears aligned with an input library and the source does not establish malicious intent.
Evidence
package.json.git/config
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The automatic preinstall runs a command that sets Git's hooks path to `git_hooks`.
- The package file allowlist omits `git_hooks`, so the configured directory is not included in the published package.
- The runtime entrypoint exports input and vector helpers, consistent with the stated input library.
Evidence against
Behavioral surface
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = yarn config-hooks
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = yarn config-hooks
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg19"preinstall": "yarn config-hooks",
"config-hooks": "git config core.hooksPath git_hooks",
"create-tag
Medium
Ai Review Evidence
The automatic preinstall runs a command that sets Git's hooks path to `git_hooks`.
package.jsonView on unpkg · L199"files": [
"examples/build",
"LICENSE",
"src",
"types",
"package.json"
],
"scripts": {
"
Medium
Ai Review Evidence
Findings
1 High4 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAi Review Evidencepackage.json
MediumAi Review Evidencepackage.json
MediumAi Review Evidencesrc/index.ts
LowScripts Present
Affected versions and remediation
This report applies to pit-js@5.1.1.
See all versions of pit-js for other recorded verdicts.
- Review the evidence and your use of pit-js@5.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.