@gkd-kit/inspect@0.0.1784022109076
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe scanner's Trojan Source and WASM indicators are false positives after source inspection. The postinstall Git-hook mutation remains a real lifecycle risk that warrants a warning, not a malicious block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation in a Git checkout
Impact
mutates the local Git hook configuration during installation
Mechanism
postinstall invokes simple-git-hooks to configure pre-commit linting
AI rationale
The scanner's Trojan Source and WASM indicators are false positives after source inspection. The postinstall Git-hook mutation remains a real lifecycle risk that warrants a warning, not a malicious block.
Evidence
package.jsondist/assets/ActionCard-B-6qZF_4.jsdist/assets/ActionCard-B-6qZF_4.js.mapdist/assets/selector-BiyQdXKP.js.mapdist/assets/storage-BFHw9nz6.js.map.git/hooks/pre-commit
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `package.json` defines `postinstall: simple-git-hooks` and a `pre-commit` hook.
- Install-time hook setup can modify `.git/hooks/pre-commit` in the consuming checkout.
Evidence against
- No package `main`/`bin` entrypoint; published payload is a browser `dist` app.
- Source maps show the WASM fetch is selector matching support, with JS fallback.
- Snapshot/image uploads occur through explicit share/export UI actions.
- The flagged Unicode is one U+FEFF BOM at `ActionCard-B-6qZF_4.js:256`, not bidi control flow.
- No shipped source references Node process, shell execution, credential paths, or remote code evaluation.
Behavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = simple-git-hooks
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = simple-git-hooks
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/assets/ActionCard-B-6qZF_4.jsView file
256contains invisible/control Unicode U+FEFF (zero width no-break space)
`,[x(`&:not(:first-child)`,`margin-top: 8px`),I(`button`,[x(`&:not(:last-child)`,`margin-right: 8px;`)])])]),En=X({name:`Popconfirm`,props:Object.assign(Object.assign(Object.assign({},i.props),te),{positiveText:String,negativeText:String,s
Critical
Findings
1 Critical1 High4 Medium5 Low
CriticalTrojan Source Unicodedist/assets/ActionCard-B-6qZF_4.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Wasm Moduledist/assets/mod-BHC4TAjm.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @gkd-kit/inspect@0.0.1784022109076.
See all versions of @gkd-kit/inspect for other recorded verdicts.
- Review the evidence and your use of @gkd-kit/inspect@0.0.1784022109076 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.