@hydranium/glsp-client-theia@1.0.0-next.392
Theia-coupled client primitives for GLSP heads built on @hydranium/glsp-server. Provides the diagram widget, manager, client contribution and connection-handler bases that Theia-based adopters extend, and binds @hydranium/glsp-client's host-neutral classe
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source behavior matches a Theia GLSP client integration: it waits for an open workspace, connects through the configured GLSP channel, and retries failures. The fingerprint alert is not supported by observed attack behavior, and the package declares no install lifecycle hook.
Decision evidence
public snapshot- The package exposes Theia browser and Node entry points for GLSP integration.
- The only lifecycle-adjacent script is prepack, which checks that built entry files exist; no install hook is declared.
- The client contribution waits for a workspace, then connects to the configured GLSP server and initializes its client.
- Channel creation listens through Theia's GLSP connection provider and closes unused channels.
- No external network URLs appear in the package's executable source; the URLs found are repository and project documentation links.
- Searches found no child_process, process.env, or file-read usage in the package source.
- The flagged client contribution implements workspace-gated GLSP connection startup and restart behavior consistent with the package's stated purpose.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
style/diagram-loading.cssView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
lib/browser/client-contribution.jsView on unpkgFindings
Affected versions and remediation
This report applies to @hydranium/glsp-client-theia@1.0.0-next.392.
See all versions of @hydranium/glsp-client-theia for other recorded verdicts.
- Review the evidence and your use of @hydranium/glsp-client-theia@1.0.0-next.392 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.