registry / @a4ui/core / 0.12.0

@a4ui/core@0.12.0

A4ui — Spatial Glass design system & component library for SolidJS (Kobalte behavior + Tailwind glass tokens + motion).

AI Security Review

scanned 6h ago · by lpm-firewall-ai

The only confirmed lifecycle surface is `prepare: husky`. It may set up local Git hooks when that lifecycle runs, but no hook payload or network/exfiltration behavior is present in the archive.

Static reason

No blocking static signals were detected.

Trigger

npm lifecycle execution of `prepare`

Impact

Potential local VCS-hook persistence; no confirmed payload or data access.

Mechanism

Husky-based Git-hook setup

Rationale

No concrete malicious behavior was found by source inspection, but the package declares a prepare-only Husky lifecycle hook. Per policy, this unresolved VCS-hook setup surface warrants a warning rather than a block.

Evidence

package.jsonsrc/index.tssrc/lib/theme.tssrc/lib/effects.tssrc/ui/FileUpload.tsxdist/index.jsdist/elements.jsdist/commerce.jsdist/charts.jsdist/elements.iife.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

@a4ui/core@0.12.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code