registry / @jean2/client / 1.3.0

@jean2/client@1.3.0

Jean2 AI Agent Client - Run the Jean2 web UI locally via npx

AI Security Review

scanned 9h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package provides a user-invoked local static server and a browser UI that communicates with a configured Jean2 server.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the `j2` CLI or opens the served UI and configures/connects to a Jean2 server.

Impact

Expected client functionality; no unconsented install-time execution, credential harvesting, exfiltration, persistence, or destructive behavior was established.

Mechanism

Local static hosting, REST requests, and WebSocket terminal/session client functionality.

Rationale

Static inspection supports a packaged Jean2 web client and opt-in CLI static server. The flagged Workbox file is standard service-worker caching code, while network and terminal capabilities are package-aligned client behavior directed at the configured server.

Evidence

package.jsondist/cli.mjsdist/sw.jsdist/workbox-2fbc6a65.jsdist/assets/_serverId-CpGI0ief.jsdist/assets/ServerContext-CEaMhGyY.jsREADME.mddist/index.htmldist/assets/auth-CJ6zmUIa.js

Network endpoints4

localhost:8742/api/info/api/auth/verify/ws/terminal

@jean2/client@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code