@hydranium/data-client-vscode@1.0.0-next.367
VS Code client primitives for the hydranium data-server protocol head; companion of @hydranium/data-server. The extension host relays the data-server's socket to a webview over a vscode-messenger hop, and the webview's data port reads it, so DataConnectio
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and inspected runtime exports implement a consumer-invoked local socket and messenger bridge. No credential collection, unrelated network transfer, or other attack behavior was identified.
Decision evidence
public snapshot- The manifest lists build, cleanup, lint, prepack, test, typecheck and watch scripts; it has no install lifecycle hook.
- The package exports point to small Node, browser and testing entrypoints.
- The Node transport connects to a supplied port, defaulting to 127.0.0.1, and exposes socket-backed message transport.
- The channel forwards messages between specified messenger endpoints; the browser port creates a JSON-RPC connection over that channel.
Source & flagged code
6 flaggedThe manifest lists build, cleanup, lint, prepack, test, typecheck and watch scripts; it has no install lifecycle hook.
package.jsonView on unpkg · L56The manifest lists build, cleanup, lint, prepack, test, typecheck and watch scripts; it has no install lifecycle hook.
package.jsonView on unpkg · L60Findings
Affected versions and remediation
This report applies to @hydranium/data-client-vscode@1.0.0-next.367.
See all versions of @hydranium/data-client-vscode for other recorded verdicts.
- Review the evidence and your use of @hydranium/data-client-vscode@1.0.0-next.367 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.