registry / @arthurka/ts-utils / 3.18.2

@arthurka/ts-utils@3.18.2

Some convenient TS utilities.

AI Security Review

scanned 14h ago · by lpm-firewall-ai

No confirmed malicious runtime attack surface. A prepare-only Husky setup may mutate local VCS-hook configuration when that lifecycle runs.

Static reason

No blocking static signals were detected.

Trigger

npm prepare during a source/git or development install

Impact

May create or update project-local Git hooks; no payload or data transfer is present.

Mechanism

conditional Husky VCS-hook installation

Rationale

Source inspection found a user-invoked download helper but no embedded destination or automatic execution. Per lifecycle policy, the prepare-only Husky setup warrants a non-blocking warning rather than a malicious block.

Evidence

package.jsondist/esm/backend.jsdist/esm/index.jsdist/cjs/backend.cjsdist/cjs/index.cjs

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json has a prepare hook that conditionally invokes husky.install().
The hook can set up VCS hooks in a source/git install context.

Evidence against

No preinstall, install, or postinstall hook is present.
Published runtime entrypoints are utility functions with no import-time side effects.
backend downloadFile requires caller-supplied URL and destination; no endpoint is embedded.
No credential harvesting, exfiltration, shell execution, eval, or destructive code found.

Behavioral surface

Source

FilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 13.3 KB of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json has a prepare hook that conditionally invokes husky.install().

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json has a prepare hook that conditionally invokes husky.install().

package.jsonView on unpkg

Findings

3 Medium3 Low

MediumNetwork

MediumAi Review Evidencepackage.json

MediumAi Review Evidence

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LPM CLI

Runtimenode 22.22.3npm 10.9.8

Artifact43.4 KB · 42 files1 signature(s)

Install lifecycleprepare

Behavioral surface

FilesystemNetworkSupply chain: cleanManifest: clean

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json has a prepare hook that conditionally invokes husky.install().

package.jsonView on unpkg