registry / @axiomantic/rhizo / 0.2.8

@axiomantic/rhizo@0.2.8

Inter-assistant communication bus, monotonic fencing locks, and work queues over Redis

AI Security Review

scanned 18h ago · by lpm-firewall-ai

No attack was identified in the inspected manifest or JavaScript launcher. The launcher acts when the user invokes the command and runs a release binary.

Static reason

One or more suspicious static signals were detected.

Trigger

The user invokes the rhizo command or imports its main entry point.

Impact

No malicious effect is established by the inspected JavaScript source; the behavior of the native binaries was not determined from that source.

Mechanism

The launcher checks for a compatible local binary, downloads a platform-specific archive from the package's GitHub releases if needed, and runs the binary with the user's arguments and environment.

AI rationale

The inspected source shows a user-invoked native CLI launcher and no install-time execution or concrete malicious behavior. Scanner signals about environment variables and executable downloads are consistent with selecting and launching the package's native program.

Evidence

bin/run.js

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes bin/run.js as the command-line entry point for an inter-assistant and Redis work-queue package.

@axiomantic/rhizo@0.2.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code