registry / @huyz0/ztui / 1.1.0

@huyz0/ztui@1.1.0

Declarative, React-based TUI framework for TypeScript and Bun — one widget tree, terminal and browser-canvas backends.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The prepare lifecycle hook can alter the enclosing repository's Git hooks path. No concrete payload, hook file, or outbound endpoint is present in this package.

Static reason

No blocking static signals were detected.

Trigger

npm prepare lifecycle in a Git worktree or other context where Git resolves a repository.

Impact

Can redirect Git hook lookup to `.githooks` in the host project, creating persistence risk if that directory is populated separately.

Mechanism

Git configuration mutation via lifecycle shell command.

Rationale

No malicious payload, exfiltration, or remote execution chain was found. The prepare-only Git hooks-path mutation is a real lifecycle persistence/control-surface risk and should be warned rather than blocked.

Evidence

package.jsonsrc/utils/sharp-sync.tssrc/utils/logger.tssrc/core/inspector.ts.githooks

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json has a prepare hook that runs `git config core.hooksPath .githooks`.
The hook suppresses errors with `|| true`, obscuring whether Git configuration changed.

@huyz0/ztui@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code