registry / postcss-processor-utils / 0.0.1-security

postcss-processor-utils@0.0.1-security

security holding package

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed attack surface exists in this extracted version. It is a metadata-only security holding package with no executable entrypoint or lifecycle hook.

Static reason

No blocking static signals were detected.

Trigger

None; installing or importing exposes no package code because no runtime entrypoint is declared.

Impact

No package-implemented execution, persistence, exfiltration, or destructive behavior found.

Mechanism

Metadata-only placeholder package

Rationale

Source inspection shows this exact version contains only a minimal manifest and a README; the README's historical claim is not executable evidence. No concrete malicious behavior is present in the package contents.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

README.md contains an unverified historical claim that a prior package release was removed for malware.

Evidence against

package.json has no scripts, bin, main, module, browser, dependencies, or executable entrypoints.
The package tree contains only package.json and README.md.
No source code, install-time hook, network endpoint, credential access, shell execution, or file mutation mechanism is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Findings

2 Low

LowNo License

LowAi Review Evidence