registry / uniweb / 0.12.44

uniweb@0.12.44

Create structured Vite + React sites with content/code separation

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `uniweb update`, `uniweb register`, or `uniweb build`.

Impact

`uniweb update` can replace the current workspace's `AGENTS.md` with the package's bundled agent guidance.

Mechanism

Explicit CLI project mutation and build-tool execution.

Rationale

Source inspection does not support a malicious verdict. The explicit project-owned AI-agent instruction mutation is a policy-relevant capability that warrants a warning, not a block.

Evidence

package.jsonsrc/commands/update.jssrc/commands/doctor.jssrc/commands/register.jssrc/commands/build.jssrc/utils/update-check.jsAGENTS.mdpartials/agents.md

Network endpoints1

registry.npmjs.org/uniweb/latest

Decision evidence

public snapshot

uniweb@0.12.44

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code