{
  "kind": "package_manifest_exec",
  "product_version": "0.12.897",
  "wheel_sha256": "a9c3bf17b036c5f661df05ba4a02cf3afa834b44c2492f3e60fb3b66061a0a24",
  "method": "Published detector functions evaluated on authored inert events or disposable configuration files.",
  "scope": "No live agent, runtime adapter, daemon ingestion, product UI, external command or network action was exercised.",
  "cases": [
    {
      "case": "install-hook",
      "inputs": {
        "file": "package.json",
        "content": {
          "name": "detector-example",
          "scripts": {
            "postinstall": "node build.js"
          }
        }
      },
      "expected_severity": "warning",
      "actual_severity": "warning",
      "findings": [
        {
          "kind": "package_manifest_exec",
          "session_id": "",
          "runtime": "unknown",
          "severity": "warning",
          "title": "package.json runs its own code on install: postinstall",
          "detail": "Installing this project's dependencies also runs the postinstall script(s) it ships. That is ordinary for many projects and it is also the mechanism the npm supply-chain attacks use, so it is worth knowing the code came with the clone. `npm install --ignore-scripts` skips them if you would rather read first.",
          "evidence": {
            "hooks": [
              "postinstall"
            ],
            "hits": [
              {
                "hook": "postinstall",
                "command": "node build.js",
                "tool": null,
                "alarm": null
              }
            ],
            "manifest": "package.json",
            "tools": [],
            "observed": "package_manifest"
          },
          "first_bad_step": null,
          "spend_at_risk_usd": 0.0,
          "spend_basis": "unknown",
          "frameworks": {
            "mapping_version": "2026-09-27.1",
            "owasp_llm": [],
            "owasp_asi": [
              "ASI04",
              "ASI05"
            ],
            "atlas": [],
            "mapped": true,
            "mode": "detect",
            "pre_action_control": false
          }
        }
      ]
    },
    {
      "case": "ordinary-script",
      "inputs": {
        "file": "package.json",
        "content": {
          "name": "detector-example",
          "scripts": {
            "test": "node build.js"
          }
        }
      },
      "expected_severity": null,
      "actual_severity": null,
      "findings": []
    }
  ]
}