No confirmed active attack surface in this package version. It is a metadata-only holding package with no executable entrypoint or lifecycle hook.
Static reason
No blocking static signals were detected.
Impact
No package-originated runtime, install-time, network, or filesystem action established.
Mechanism
No executable behavior.
Rationale
Direct inspection shows the published version is a non-executable security placeholder. The README's historical claim does not establish malicious behavior in @dsft/ft-utils@0.0.1-security.