registry / stream-chat / 9.53.0
stream-chat@9.53.0
JS SDK for the Stream Chat API
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe lifecycle hook conditionally imports an installer file that is not present in this package snapshot. Runtime reporting is gated by enableInsights and targets the package vendor’s insights service, so the inspected behavior does not establish malicious activity.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation for the conditional postinstall check; runtime insight reporting requires enableInsights to be enabled and a qualifying connection event.
Impact
No confirmed attack surface was established; enabled diagnostics can include a session token and user details.
Mechanism
The lifecycle command imports the Husky installer only if its file exists. Runtime insight reporting sends connection diagnostics to the package vendor’s insights endpoint when enabled.
AI rationale
The lifecycle hook conditionally imports an installer file that is not present in this package snapshot. Runtime reporting is gated by enableInsights and targets the package vendor’s insights service, so the inspected behavior does not establish malicious activity.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json guards the postinstall import with a check that the installer file exists; that file is absent from the package snapshot.
- The ESM, browser CommonJS, and Node CommonJS bundles gate WebSocket insight sends on enableInsights.
- Insights go to the package vendor’s chat-insights.getstream.io endpoint and include token and user details when sent.
- The client options set warmUp to false and do not enable insights by default.
Evidence against
- The insight payload contains authentication and user data, so enabling insights sends sensitive diagnostics to the vendor endpoint.
Behavioral surface
CryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node -e "require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg106"postinstall": "node -e \"require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')\"",
"prepare": "yarn run build"
},
"engines": {
High
Missing Postinstall Target
package.json guards the postinstall import with a check that the installer file exists; that file is absent from the package snapshot.
package.jsonView on unpkg · L106Findings
1 Critical2 High2 Medium7 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighMissing Postinstall Targetpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencedist/esm/index.mjs
LowAi Review Evidencedist/cjs/index.browser.js
Affected versions and remediation
This report applies to stream-chat@9.53.0.
See all versions of stream-chat for other recorded verdicts.
- Review the evidence and your use of stream-chat@9.53.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.