@gkd-kit/inspect@0.0.1785940736532
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an install-time VCS hook mutation and merits a warning, but the inspected source supports a conventional lint-staged workflow rather than concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install; later, a git commit in the containing repository.
Impact
Can alter the repository's pre-commit behavior; no confirmed data theft, remote execution, or AI-agent control-surface mutation.
Mechanism
postinstall VCS-hook setup
AI rationale
This is an install-time VCS hook mutation and merits a warning, but the inspected source supports a conventional lint-staged workflow rather than concrete malicious behavior.
Evidence
package.jsondist/index.htmldist/assets/ActionCard-C3CVutCf.jsdist/assets/sql-wasm-browser-D0MAxtwm.js.git/hooks/pre-commit
Network endpoints1
registry.npmmirror.com/@gkd-kit/inspect/0.0.1785940736532/files/dist/
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json defines postinstall: simple-git-hooks.
- package.json configures a pre-commit hook that runs pnpm exec lint-staged.
- dist/index.html loads the application modules from registry.npmmirror.com.
Evidence against
- The hook is a visible VCS pre-commit lint/format workflow, not credential or agent-control code.
- No child-process, eval, environment harvesting, or exfiltration was found in shipped runtime bundles.
- No bidi control characters were found in dist/assets/ActionCard-C3CVutCf.js.
- WASM assets are browser SQL/selector functionality; no payload-loading chain was established.
Behavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•dependencies.@antv/g6 = ^5.1.1
previous = 5.1.1
independentlyConfirmedMalicious = @antv/g6@5.3.1 (OpenSSF Malicious Packages via OSV)
Critical
Known Malicious Dependency Insertion
A newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.
package.jsonView on unpkg•scripts.postinstall = simple-git-hooks
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = simple-git-hooks
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/assets/ActionCard-C3CVutCf.js
Findings
2 Critical1 High4 Medium5 Low
CriticalTrojan Source Unicodedist/assets/ActionCard-C3CVutCf.js
CriticalKnown Malicious Dependency Insertionpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Wasm Moduledist/assets/sql-wasm-UFUCzYNW.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @gkd-kit/inspect@0.0.1785940736532.
See all versions of @gkd-kit/inspect for other recorded verdicts.
- Review the evidence and your use of @gkd-kit/inspect@0.0.1785940736532 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.