registry / @intentius/chant-lexicon-github / 0.17.0

@intentius/chant-lexicon-github@0.17.0

GitHub Actions lexicon for chant — declarative IaC in TypeScript

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious package attack surface. The package is a GitHub Actions lexicon and generator; its network access is limited to an explicit schema-fetch helper.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes schema/code-generation functionality or uses composites to generate a workflow.

Impact

Generated workflow commands execute only in the consumer's GitHub Actions workflow and are supplied by the consumer; no install-time or import-time attack behavior was found.

Mechanism

Generates GitHub Actions definitions and optionally downloads a public workflow schema with local caching.

Rationale

Source inspection finds no malicious behavior. Static findings reflect explicit code-generation features, package-aligned runtime loading, and secret-detection test fixtures.

Evidence

package.jsonsrc/spec/fetch.tssrc/composites/deploy-environment.tssrc/plugin.tssrc/lint/rules/rules.test.ts

Network endpoints1

json.schemastore.org/github-workflow.json

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with false-positive risk.

@intentius/chant-lexicon-github@0.17.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code