registry / @axiomantic/garden / 0.2.1

@axiomantic/garden@0.2.1

Multi-Agent Swarm Orchestration, Empirical Dialectics & Ceremonies on top of Rhizo & Vine

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious behavior was identified in the inspected JavaScript source. The launcher can select a bundled native executable or download one from the package’s release repository and run it.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the garden command or importing the package entrypoint.

Impact

The native program’s behavior is unresolved because the shipped executable is not inspectable as source here.

Mechanism

The launcher checks for a compatible binary, downloads and extracts a release archive when needed, then starts the selected executable with inherited arguments and environment.

AI rationale

The source shows an invocation-triggered native launcher and no install-time lifecycle hook. Because the native payload could not be inspected, its runtime behavior remains unresolved; the evidence supports a warning, not a finding of malicious activity.

Evidence

bin/run.jsbin/binaries/garden-linux-x64

Network endpoints1

github.com/axiomantic/garden/releases/download/v${VERSION}/${assetName}

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.

@axiomantic/garden@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code