@hydranium/data-client-vscode@1.0.0-next.382
VS Code client primitives for the hydranium data-server protocol head; companion of @hydranium/data-server. The extension host relays the data-server's socket to a webview over a vscode-messenger hop, and the webview's data port reads it, so DataConnectio
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest contains no lifecycle hooks, and its entry points expose transport utilities without performing a connection on import. Socket and messenger activity is initiated through consumer-called APIs and serves the package’s stated VS Code data-client purpose.
Decision evidence
public snapshot- The manifest defines package entry points and exports, with no install, preinstall, or postinstall hook.
- The listed scripts are build, clean, lint, test, watch, and a prepack packaging guard.
- The socket transport is created by an exported function and defaults to connecting to 127.0.0.1; the caller supplies the port and may supply a host.
- The connection function relays messages between the caller-provided webview messenger and the data-server socket.
Source & flagged code
4 flaggedThe manifest defines package entry points and exports, with no install, preinstall, or postinstall hook.
package.jsonView on unpkg · L32The listed scripts are build, clean, lint, test, watch, and a prepack packaging guard.
package.jsonView on unpkg · L56Findings
Affected versions and remediation
This report applies to @hydranium/data-client-vscode@1.0.0-next.382.
See all versions of @hydranium/data-client-vscode for other recorded verdicts.
- Review the evidence and your use of @hydranium/data-client-vscode@1.0.0-next.382 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.