registry / @gkd-kit/inspect / 0.0.1787391655035
@gkd-kit/inspect@0.0.1787391655035
⚠ Under reviewAI Security Review
scanned 11d ago · by lpm-firewall-aiThe inspected postinstall behavior configures Git hooks, and the flagged invisible characters appear in identifier parsing. However, the large graph bundle remains unresolved, so there is not enough source evidence for either a clean verdict or a concrete warning or block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The postinstall hook runs during package installation; the unresolved bundle is used by the package’s browser application.
Impact
No harmful effect was established; the unresolved bundle prevents a confident clean assessment.
Mechanism
The hook invokes Git hook setup, while the inspected bundle excerpts show application and parser code. The rest of the large bundle was not resolved in this inspection.
AI rationale
The inspected postinstall behavior configures Git hooks, and the flagged invisible characters appear in identifier parsing. However, the large graph bundle remains unresolved, so there is not enough source evidence for either a clean verdict or a concrete warning or block.
Evidence
dist/assets/TrackGraph-yo6P-g1X.jspackage.jsondist/assets/selector-SVi350do.jsdist/assets/dist-BPftzEoa.js
Decision evidence
public snapshotAI called this Manual Review at 66.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs simple-git-hooks at postinstall; its configured pre-commit hook runs lint-staged.
- The large graph bundle starts with imports from local application modules and browser libraries; its full behavior remains unresolved.
- The flagged invisible characters are accepted as identifier continuation characters in a parser helper.
- The selector bundle starts with local storage and node module imports, followed by compatibility helpers.
Evidence against
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = simple-git-hooks
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = simple-git-hooks
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/assets/dist-BPftzEoa.jsView file
4contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:W(),R=`default`;return;case void 0:return W(),K(`eof`)}W()},value:function(){switch(H){case`{`:case`[`:return K(`punctuator`,W());case`n`:return W(),q(`ull`),K(`null`,null);case`t`:return W(),q(`rue`),K(
Critical
Trojan Source Unicode
Findings
1 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist/assets/dist-BPftzEoa.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/assets/TrackGraph-yo6P-g1X.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Wasm Moduledist/assets/retrace-wasm-Cwxm7tYJ.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @gkd-kit/inspect@0.0.1787391655035.
See all versions of @gkd-kit/inspect for other recorded verdicts.
- Review the evidence and your use of @gkd-kit/inspect@0.0.1787391655035 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.