registry / stream-chat / 9.52.1
stream-chat@9.52.1
JS SDK for the Stream Chat API
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe critical lifecycle finding is a false positive in this snapshot because its only target file is absent. The remaining network behavior is package-aligned chat and opt-in insight functionality, with no concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package or using the chat client with insight reporting enabled.
Impact
No install-time mutation or malicious execution was confirmed.
Mechanism
A guarded no-op install hook and package-aligned chat telemetry.
AI rationale
The critical lifecycle finding is a false positive in this snapshot because its only target file is absent. The remaining network behavior is package-aligned chat and opt-in insight functionality, with no concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines an inline postinstall command.
- The SDK can post connection-insight data to a Stream-owned telemetry host.
Evidence against
- The postinstall command only imports scripts/install-husky.mjs when it exists; that file is absent from this package snapshot, so the hook is a no-op.
- The manifest contains no self-dependency or install-time downloaded payload.
- Insight reporting is conditional on enableInsights and is part of the chat SDK's connection handling.
- No source evidence shows credential harvesting, shell execution, project mutation, or persistence.
Behavioral surface
ChildProcessCryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node -e "require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg106"postinstall": "node -e \"require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')\"",
Low
Suspicious Lifecycle Evidence
The manifest defines an inline postinstall command.
package.jsonView on unpkg · L106src/insights.tsView file
Findings
1 Critical1 High2 Medium7 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/insights.ts
Affected versions and remediation
This report applies to stream-chat@9.52.1.
See all versions of stream-chat for other recorded verdicts.
- Review the evidence and your use of stream-chat@9.52.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.