registry / @agimon-ai/po-config / 0.0.0-alpha.92
@agimon-ai/po-config@0.0.0-alpha.92
Typed configuration loading, validation, and host services for composing Po sessions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged files support configuration and paired-device runtime behavior; the credential-related helper checks local configuration presence rather than transmitting credentials. The package declares no install lifecycle hooks, and its metadata and exports are consistent with its stated configuration-library purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the library exposes configuration functions; filesystem and remote runtime operations are used by the corresponding services.
Impact
No unauthorized credential transfer, install-time activity, or other malicious impact was identified.
Mechanism
The inspected credential helper checks for local model configuration, and the remote route requires an authorized paired device and sealed request.
AI rationale
The flagged files support configuration and paired-device runtime behavior; the credential-related helper checks local configuration presence rather than transmitting credentials. The package declares no install lifecycle hooks, and its metadata and exports are consistent with its stated configuration-library purpose.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes typed configuration loading and exports its library through dist entry points.
- The package scripts are build, test, typecheck, lint and formatting tasks; no install lifecycle script is declared.
- The flagged dependency helper checks whether local Pi model configuration exists; it does not send credential values.
- The dependency’s remote HTTP route requires an authorized paired device and a sealed request envelope.
Evidence against
- The package depends on @agimon-ai/po-core, whose inspected source reads auth.json to determine whether model configuration exists.
- The package contains filesystem and network-related functionality consistent with configuration and remote runtime services.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/config-ch_DJeTs.cjsView file
8package = @agimon-ai/po-config; repositoryIdentity = po; dependency = yaml
L8: node_fs = require_rolldown_runtime.__toESM(node_fs, 1);
L9: let yaml = require("yaml");
L10: //#region src/services/config/sync.ts
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/config-ch_DJeTs.cjsView on unpkg · L8package.jsonView file
35"type": "module",
"main": "./dist/index.cjs",
"types": "./dist/index.d.mts",
"jsnext:main": "./dist/index.mjs",
"exports": {
".": {
"types": "./dist/index.d.mts",
Low
Ai Review Evidence
The package describes typed configuration loading and exports its library through dist entry points.
package.jsonView on unpkg · L35197"scripts": {
"build": "tsdown && pnpm build:mcp",
"build:mcp": "tsdown --config tsdown.mcp.config.ts",
"test": "vitest --run",
"typecheck": "tsrs --noEmit && tsrs --noEmit
Findings
1 High4 Medium7 Low
HighCopied Package Dependency Bridgedist/config-ch_DJeTs.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadata.lpm-dependency-evidence-2868826c-016e-4d0b-a55d-3075385be066/0/npm-linux/dist/remoteRuntime.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-2868826c-016e-4d0b-a55d-3075385be066/0/npm-linux/dist/src/services/piSettings/sync.mjs
Affected versions and remediation
This report applies to @agimon-ai/po-config@0.0.0-alpha.92.
See all versions of @agimon-ai/po-config for other recorded verdicts.
- Review the evidence and your use of @agimon-ai/po-config@0.0.0-alpha.92 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.