registry / @lgtm-hq/turbo-themes / 0.28.8

@lgtm-hq/turbo-themes@0.28.8

Universal theme packs and an accessible theme selector.

AI Security Review

scanned 13h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime code provides theme metadata and browser-side theme selection only.

Static reason

No blocking static signals were detected.

Trigger

Package import or browser DOMContentLoaded.

Impact

No credential access, exfiltration, code execution, persistence, or destructive behavior established.

Mechanism

Same-origin stylesheet switching and localStorage theme preference persistence.

Rationale

Static inspection shows a theme/CSS package with a development-only prepare hook and browser UI behavior. The environment-variable references only suppress development warnings; no concrete malicious chain is present.

Evidence

package.jsondist/index.jspackages/theme-selector/dist/index.jspackages/core/dist/index.jsdist/themes/registry.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

`package.json` has no preinstall/install/postinstall hook; `prepare` is `husky || true`.
`dist/index.js` only re-exports bundled core and selector modules.

@lgtm-hq/turbo-themes@0.28.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code