registry / @dsft/ft-utils / 0.0.1-security

@dsft/ft-utils@0.0.1-security

security holding package

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed active attack surface in this package version. It is a metadata-only holding package with no executable entrypoint or lifecycle hook.

Static reason

No blocking static signals were detected.

Trigger

None.

Impact

No package-originated runtime, install-time, network, or filesystem action established.

Mechanism

No executable behavior.

Rationale

Direct inspection shows the published version is a non-executable security placeholder. The README's historical claim does not establish malicious behavior in @dsft/ft-utils@0.0.1-security.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

README.md states this is a security holding package replacing a removed malicious release.

Evidence against

package.json has no scripts, dependencies, bin, or code entrypoints.
Package contains only package.json and README.md.
No executable source, network logic, file access, or install-time behavior exists.

@dsft/ft-utils@0.0.1-security

AI Security Review

Decision evidence

Source & flagged code

Findings