registry / wrong-notebook / 2026.10.22
wrong-notebook@2026.10.22
⚠ Under review错题本：上传题目图片，由 AI 识别、解析并标注知识点，支持练习、统计与打印导出
AI Security Review
scanned 14d ago · by lpm-firewall-aiManual review is warranted because selected Prisma and Next dependencies are unresolved, while source shows they are active in the install and runtime paths. The inspected package code alone does not establish an attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation invokes Prisma generation; starting the application invokes Prisma setup and the Next server.
Impact
The unresolved dependency behavior prevents confirming that the package is clean; no specific harmful effect was established.
Mechanism
The inspected package code generates the Prisma client, prepares the database, and starts Next. The behavior of the selected Prisma and Next dependency sources could not be verified.
AI rationale
Manual review is warranted because selected Prisma and Next dependencies are unresolved, while source shows they are active in the install and runtime paths. The inspected package code alone does not establish an attack.
Evidence
package.jsonbin/wrong-notebook.jslauncher.jsserver.js
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest runs a Prisma Client generation command after installation and declares Prisma and Next as dependencies.
- The install command invokes Prisma generation; runtime startup also uses Prisma for database setup and migrations.
- The server imports Next to start the application, but the selected Prisma and Next dependency sources were unresolved in the available inspection.
Evidence against
- The inspected install and launch code performs application setup and server startup; it does not establish a concrete attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg•scripts.postinstall = node bin/wrong-notebook.js prepare-client
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/wrong-notebook.js prepare-client
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg34"scripts": {
"postinstall": "node bin/wrong-notebook.js prepare-client"
},
"dependencies": {
"@prisma/client": "5.22.0",
"bcryptjs": "3.0.3",
"google-auth-library": "10.5
Findings
1 Critical1 High6 Medium4 Low
CriticalManifest Confusionpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Pattern.next/server/chunks/ssr/src_1o363ao._.js
MediumDynamic Requirebin/wrong-notebook.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Pattern.next/static/chunks/3hz1l3qoxv84t.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Dependency Evidencepackage.json
Affected versions and remediation
This report applies to wrong-notebook@2026.10.22.
See all versions of wrong-notebook for other recorded verdicts.
- Review the evidence and your use of wrong-notebook@2026.10.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.