registry / @centralping/ergo / 0.7.0

@centralping/ergo@0.7.0

A Fast Fail REST API toolkit for Node.js -- composable middleware with structured Negotiation, Authorization, Validation, and Execution stages.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

No confirmed malware behavior or outbound exfiltration is present. A prepare lifecycle script can install a project-local Git pre-commit hook.

Static reason

No blocking static signals were detected.

Trigger

Running npm prepare in a Git checkout.

Impact

Can alter local commit-time behavior by running lint-staged.

Mechanism

VCS hook setup through simple-git-hooks

Rationale

Inspected source is a REST middleware toolkit with no concrete malicious chain. The prepare-only Git hook setup remains a lifecycle risk under firewall policy.

Evidence

package.jsonhttp/main.jshttp/handler.jshttp/logger.jslib/authorization.js.git/hooks/pre-commit

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json defines prepare: simple-git-hooks and a pre-commit hook.
The configured hook invokes npx lint-staged, changing VCS-hook behavior when prepare runs.

@centralping/ergo@0.7.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code