registry / @axiomantic/vine / 0.2.1

@axiomantic/vine@0.2.1

Sub-Second APFS Copy-on-Write Workspaces & Zero-Mirage Git Weaving Engine

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No attack was identified in the inspected launcher source. It selects a native CLI binary, downloading a versioned release from the package’s repository if needed, then invokes it for the user’s command.

Static reason

One or more suspicious static signals were detected.

Trigger

The user invokes the vine CLI.

Impact

The native CLI performs the requested command; its internal behavior was not assessed from source.

Mechanism

The launcher may download a versioned native binary from the package’s GitHub release and executes the selected binary with the CLI arguments and current environment.

AI rationale

The inspected source shows a package-aligned CLI launcher and no confirmed attack behavior. Bundled and downloaded native binary internals were not assessed, but the available source does not establish an attack surface.

Evidence

bin/run.js

Network endpoints1

github.com/axiomantic/vine/releases/download/v${VERSION}/${assetName}

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes bin/run.js as the package CLI entry point.

@axiomantic/vine@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code