No confirmed malicious attack surface. The browser selector only persists a selected theme locally and loads package theme CSS through same-origin paths.
Static reason
No blocking static signals were detected.
Trigger
Importing `@lgtm-hq/turbo-themes/selector` in a browser registers a DOMContentLoaded theme-selector initializer.
Impact
Changes the consuming page's theme-related DOM attributes, stylesheet link, and localStorage preference; no host-system mutation or exfiltration is established.
Mechanism
Local theme preference and same-origin stylesheet selection.
Rationale
The package is a compiled theme library with no install-time execution, privileged primitives, credential access, or outbound communication. Its browser-side DOM and localStorage behavior is package-aligned theme selection with same-origin CSS validation.
Evidence
package.jsondist/index.jspackages/core/dist/index.jspackages/theme-selector/dist/index.jsdist/tokens/index.jsdist/adapters/tailwind/preset.jspackages/adapters/bulma/dist/index.js