registry / @gkd-kit/inspect / 0.0.1787845264330
@gkd-kit/inspect@0.0.1787845264330
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection found a git-hook setup command configured for linting and formatting, plus ordinary route handling and text-download behavior in the inspected bundles. The scanner indicators do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation invokes the postinstall hook; no harmful install behavior was found in the inspected source.
Impact
No harmful effect was established from the inspected behavior.
Mechanism
The hook invokes simple-git-hooks, configured to run lint-staged on pre-commit. The inspected bundle code performs route handling and adds a byte order mark to text downloads.
AI rationale
Source inspection found a git-hook setup command configured for linting and formatting, plus ordinary route handling and text-download behavior in the inspected bundles. The scanner indicators do not establish malicious behavior.
Evidence
package.jsondist/assets/vue-router-BwzYYogk.jsdist/assets/ActionCard--w2jQnab.js
Decision evidence
public snapshotAI called this Clean at 76.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook runs simple-git-hooks, and the manifest configures a pre-commit lint-staged hook.
- The flagged router code handles path normalization and route state; the inspected excerpt shows no harmful operation.
- The invisible character in the flagged bundle excerpt is a UTF-8 byte order mark added to text downloads.
- The element modules implement graph node and shape rendering, styling, and geometry; the layout modules define layout classes and retain their context and options.
- The plugin modules provide graph visualization and UI extensions, including camera settings, lens and zoom behavior, history, minimaps, toolbars, and tooltips.
- The registry and utility modules provide graph extension slots and helpers for formatting, bounds, points, DOM sizing, edges, event elements, vectors, z-index, anchors, placement, pinch gestures, and traversal.
- The runtime and transform modules manage graph animation, batching, behaviors, data, elements, layout, options, plugins, viewport, and graph drawing and data transforms.
- The graph package exports animation presets, palettes, themes, event types, and registry constants.
Evidence against
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = simple-git-hooks
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = simple-git-hooks
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg78"simple-git-hooks": {
"pre-commit": "pnpm exec lint-staged"
},
"lint-st
Low
Suspicious Lifecycle Evidence
The postinstall hook runs simple-git-hooks, and the manifest configures a pre-commit lint-staged hook.
package.jsonView on unpkg · L78dist/assets/ActionCard--w2jQnab.jsView file
Findings
1 Critical1 High4 Medium6 Low
CriticalTrojan Source Unicodedist/assets/ActionCard--w2jQnab.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Wasm Moduledist/assets/regex-wasm-Dbo3-vEA.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @gkd-kit/inspect@0.0.1787845264330.
See all versions of @gkd-kit/inspect for other recorded verdicts.
- Review the evidence and your use of @gkd-kit/inspect@0.0.1787845264330 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.