A prepare lifecycle command conditionally invokes Husky setup. The exported download helper fetches a caller-provided URL to a caller-provided path; no automatic trigger or payload execution is present.
Static reason
No blocking static signals were detected.
Trigger
prepare lifecycle execution; explicit downloadFile(url, filePath) call
Impact
Potential local development VCS-hook mutation; no confirmed exfiltration, remote execution, or persistence beyond that setup
Mechanism
Guarded VCS-hook setup and caller-directed file download
Rationale
This is not malicious, but the packaged prepare hook fits the policy's prepare-only VCS-hook setup warning category. The network/file primitive is explicit and user-directed.
Evidence
package.jsondist/esm/backend.jsdist/cjs/backend.cjsdist/esm/index.js