@agimon-ai/po-config
Typed configuration loading, validation, and host services for composing Po sessions.
This report shows the evidence for @agimon-ai/po-config@0.0.0-alpha.99. 0 of 65 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source behavior matches the package’s configuration purpose. The flagged dependency bridge and request handler are ordinary runtime integrations; no automatic exfiltration or unrelated action was found.
Decision evidence
public snapshot- The package describes itself as typed configuration loading and validation for Po sessions.
- The manifest exposes local config modules and lists build, test, typecheck, lint, and formatting scripts; it has no install lifecycle hook.
- The CommonJS entry loads local modules and re-exports their APIs.
- The flagged runtime bridge uses po-core’s platform service to locate and load user and repository configuration.
- The settings API handles requests passed to its fetch method; no outbound network behavior was identified.
- The package imports filesystem and environment APIs to load configuration, which matches its stated purpose.
- The copied-dependency finding is a runtime import of @agimon-ai/po-core/platform, declared as a dependency.
- The source contains network-related strings and a request handler, but no automatic outbound contact or credential transport was identified.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/config-ch_DJeTs.cjsView on unpkg · L8The flagged runtime bridge uses po-core’s platform service to locate and load user and repository configuration.
dist/config-ch_DJeTs.cjsView on unpkg · L29Findings
Affected versions and remediation
This report applies to @agimon-ai/po-config@0.0.0-alpha.99.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @agimon-ai/po-config@0.0.0-alpha.99 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.