registry / @axiomantic/vine / 0.2.2

@axiomantic/vine@0.2.2

Sub-Second APFS Copy-on-Write Workspaces & Zero-Mirage Git Weaving Engine

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No attack was identified in the inspected launcher behavior. It selects or downloads a platform binary for the CLI and passes through the caller’s arguments.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the vine CLI when no compatible bundled or cached binary is available triggers the release download.

Impact

The inspected source establishes ordinary CLI execution and no confirmed attack surface.

Mechanism

The launcher downloads a versioned asset from the project’s GitHub releases, then runs the selected binary with the caller’s arguments and environment.

AI rationale

The manifest has no install lifecycle hook, and the inspected launcher downloads from the package’s own versioned GitHub release only as a CLI fallback. The scanner signals do not establish malicious behavior.

Evidence

bin/run.js

Network endpoints1

github.com/axiomantic/vine/releases/download/v${VERSION}/${assetName}

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes bin/run.js as the CLI and declares no lifecycle scripts.

@axiomantic/vine@0.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code