@finos/legend-application-marketplace@0.4.5
Legend Marketplace application core
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the CSS finding is explained by a UTF-8 BOM rather than Trojan Source control characters. The reviewed entry point and changed catalog code show ordinary application exports and authenticated requests to the configured marketplace client.
Decision evidence
public snapshot- The package manifest has no install lifecycle hook; its scripts are build, development, lint, publish-preparation, and test commands.
- The main export points to lib/index.js, which re-exports application and UI modules.
- The flagged CSS contains a UTF-8 BOM before ordinary stylesheet selectors; searches found no bidi controls.
- MCP catalog requests use the configured marketplace server client and the user's access token.
- The catalog fetch is triggered by the Agents view effect and only proceeds when an access token exists.
Source & flagged code
7 flaggedSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
lib/index.cssView on unpkg · L17A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/index.cssView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
Affected versions and remediation
This report applies to @finos/legend-application-marketplace@0.4.5.
See all versions of @finos/legend-application-marketplace for other recorded verdicts.
- Review the evidence and your use of @finos/legend-application-marketplace@0.4.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.