Loading npm security reports…

turbolint-cli@0.1.7: Suspicious npm security report (Warn) | LPM Firewall

registry / turbolint-cli / 0.1.7

turbolint-cli@0.1.7

TurboLint is a fast Rust CLI for JavaScript and TypeScript linting.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.17 KB of source

Source & flagged code

1 flagged

package.jsonView file

Lines 13-51json

13 "type": "individual",

14 "url": "https://turbolint.ideatr.dev/#support"

15 },

16 "bugs": {

17 "url": "https://github.com/arjunkshah/turbolint-cli/issues"

18 },

19 "keywords": [

20 "linter",

21 "javascript",

22 "typescript",

23 "rust",

24 "cli",

25 "oxc",

26 "turbolint"

27 ],

28 "bin": {

29 "turbolint": "bin/turbolint.js"

30 },

31 "scripts": {

32 "build:native": "cargo build --release --locked",

33 "postinstall": "node ./scripts/install-native.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 },

35 "files": [

36 "bin/",

37 "scripts/install-native.mjs",

38 "src/",

39 "Cargo.toml",

40 "Cargo.lock",

41 "README.md",

42 "LICENSE"

43 ],

44 "publishConfig": {

45 "access": "public"

46 },

47 "engines": {

48 "node": ">=18"

49 }

50}

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-native.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code