@hydranium/data-client-vscode@1.0.0-next.392
VS Code client primitives for the hydranium data-server protocol head; companion of @hydranium/data-server. The extension host relays the data-server's socket to a webview over a vscode-messenger hop, and the webview's data port reads it, so DataConnectio
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest contains no install lifecycle hook, and the main entry only re-exports a messenger channel. Network activity is limited to explicit data-server connection methods, which use a caller-supplied port and default to loopback.
Decision evidence
public snapshot- The manifest points to library entry points and declares no install, preinstall or postinstall lifecycle hook.
- The package scripts are build, clean, lint, prepack, test, typecheck and watch; the prepack script checks build output.
- Importing the main entry point re-exports the messenger channel; it does not start a connection.
- Socket transport opens only when connection methods are called, using a caller-provided port and a loopback host by default.
- The Node entry point can open a socket and relay JSON-RPC messages, which is network activity, but the source describes it as communication with the package's data server.
- The socket host can be supplied by the caller, so the default loopback endpoint is not enforced.
Source & flagged code
5 flaggedThe manifest points to library entry points and declares no install, preinstall or postinstall lifecycle hook.
package.jsonView on unpkg · L32The package scripts are build, clean, lint, prepack, test, typecheck and watch; the prepack script checks build output.
package.jsonView on unpkg · L56Findings
Affected versions and remediation
This report applies to @hydranium/data-client-vscode@1.0.0-next.392.
See all versions of @hydranium/data-client-vscode for other recorded verdicts.
- Review the evidence and your use of @hydranium/data-client-vscode@1.0.0-next.392 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.