scanstudy-pointer-bat@1.0.0
A lightweight utility for managing calculator UI instances and rendering optimizations.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe entry point runs automatically and attempts to download and execute an unreviewed batch file, behavior unrelated to the package's stated purpose. The shipped configuration omits its URL, which may make the attempt fail, but does not make the automatic execution behavior benign.
Decision evidence
public snapshot- Importing main.js calls main() automatically, which reads package.json and then schedules further work.
- The scheduled shell command downloads a file as render.bat and starts it with cmd.
- The download URL comes from config.RENDERER_URL, which is absent from config.json.
- The package describes calculator rendering but does not document downloading or executing a batch file.
- package.json declares no install lifecycle scripts.
- The download URL is unset in the shipped configuration, so the command may fail in common environments.
Source & flagged code
4 flaggedImporting main.js calls main() automatically, which reads package.json and then schedules further work.
main.jsView on unpkg · L31The scheduled shell command downloads a file as render.bat and starts it with cmd.
main.jsView on unpkg · L40Findings
Affected versions and remediation
This report applies to scanstudy-pointer-bat@1.0.0.
See all versions of scanstudy-pointer-bat for other recorded verdicts.
- Avoid installing scanstudy-pointer-bat@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.