registry / AI-agent control-surface risk / siro_lib
siro_lib
This report shows the evidence for siro_lib@0.2.514, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found no install/import malware in the library bundle, but the shipped .claude local permission file is a concrete unconsented AI-agent control-surface risk that can expose npm identity/config and local files. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening or working in the package with an agent that honors .claude/settings.local.json
Impact
May permit credential/config inspection and broad local file reads through the agent environment
Mechanism
AI-agent permission expansion for npm credential commands and home-directory reads
Policy narrative
A developer or reviewer opening the extracted package with a Claude-compatible agent may have local permissions expanded by .claude/settings.local.json. The allowed actions include npm config/whoami commands and reading a user home path, while .env also contains plaintext credential-like values. The bundled React library itself appears package-aligned, so the blocking concern is the included AI-agent control surface rather than install-time npm execution.
AI rationale
Static inspection found no install/import malware in the library bundle, but the shipped .claude local permission file is a concrete unconsented AI-agent control-surface risk that can expose npm identity/config and local files. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsondist/index.jsdist/index.es.js.claude/settings.local.json.env
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 86.0% confidence with low false-positive risk.
Evidence for policy risk
- .claude/settings.local.json grants Bash(npm config *), Bash(npm whoami *), and home-directory Read permissions
- Package includes .env with plaintext account/password-like configuration
- AI-agent settings are unrelated to a React component library runtime
Evidence against
- package.json has no install/preinstall/postinstall lifecycle hooks
- dist/index.js and dist/index.es.js are bundled React/UI code with Siro service calls and asset URLs
- Network endpoints are package-aligned content/product/user/order/payment/CDN services
- No child_process, shell execution, native binary loading, or credential exfiltration code found in dist entrypoints
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedTrivialUrlStrings
Source & flagged code
3 flagged · loading sourcedist/index.jsView file
1patternName = supabase_service_key
severity = critical
line = 1
matchedText = "use str...=Ns;
Critical
1patternName = supabase_service_key
severity = critical
line = 1
matchedText = "use str...=Ns;
Critical
dist/index.es.jsView file
1patternName = supabase_service_key
severity = critical
line = 1
matchedText = import e...lt};
Critical
Findings
3 Critical2 Medium3 Low
CriticalCritical Secretdist/index.js
CriticalSecret Patterndist/index.js
CriticalSecret Patterndist/index.es.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to siro_lib@0.2.514.
The versions list below shows the verdict for each recorded version.
- Avoid installing siro_lib@0.2.514. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.