registry  /  @eturnity/eturnity_maths  /  9.25.0-panel-placement.2

@eturnity/eturnity_maths@9.25.0-panel-placement.2

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The only install-adjacent surface is the `prepare` hook invoking Husky for a package-local Git hook. No confirmed network, credential, payload-loading, or destructive behavior is present.

Static reason
No blocking static signals were detected.
Trigger
Installing the package in a Git working tree, then making a Git push.
Impact
May affect local Git hook behavior by running the package test command before pushes.
Mechanism
prepare-time Husky VCS-hook setup; pre-push test invocation
Rationale
This is not malicious, but the install-time `prepare` lifecycle can establish a VCS hook and is therefore warned under the install-control-surface policy. The hook content is limited to tests and no concrete harmful behavior was found.
Evidence
package.json.husky/pre-pushscripts/merge-master.jssrc/index.js

Decision evidence

public snapshot
AI called this Suspicious at 88.0% confidence as Dangerous Capability with high false-positive risk.
Evidence for warning
  • `package.json` defines install-time `prepare: husky`.
  • `.husky/pre-push` invokes `npm run test`, indicating a VCS hook payload.
  • `scripts/merge-master.js` uses Git and filesystem mutation, but only via explicit `merge-remote-master`.
Evidence against
  • `src/index.js` only re-exports local math/geometry modules.
  • No `preinstall`, `install`, or `postinstall` lifecycle hooks are defined.
  • Source audit found no credential harvesting, network clients, dynamic evaluation, or runtime child-process use.
  • The included hook runs tests only; no exfiltration or destructive commands were found.
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 85 file(s), 383 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•Published source reference
Medium
Ai Review Evidence

`package.json` defines install-time `prepare: husky`.

package.jsonView on unpkg
scripts/merge-master.jsView file
•Published source reference
Medium
Ai Review Evidence

`scripts/merge-master.js` uses Git and filesystem mutation, but only via explicit `merge-remote-master`.

scripts/merge-master.jsView on unpkg

Findings

3 Medium3 Low
MediumAi Review Evidencepackage.json
MediumAi Review Evidence
MediumAi Review Evidencescripts/merge-master.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem