No confirmed malicious attack surface. Runtime code provides theme metadata and an opt-in DOM selector that switches same-origin CSS assets.
Static reason
No blocking static signals were detected.
Trigger
Consumer imports the package and calls its theme-selector APIs.
Impact
Changes page theme styling and stores the selected theme locally.
Mechanism
Local theme CSS selection and browser preference storage.
Rationale
The published entrypoints are theme/token exports; the selector's DOM behavior is package-aligned and restricts CSS paths to the current origin. No credential access, exfiltration, payload execution, persistence, destructive behavior, or AI-agent control-surface mutation was found.
Evidence
package.jsondist/index.jspackages/core/dist/index.jspackages/theme-selector/dist/index.js