registry / @lgtm-hq/turbo-themes / 0.29.1

@lgtm-hq/turbo-themes@0.29.1

Universal theme packs and an accessible theme selector.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

The only flagged surface is the prepare lifecycle invoking Husky, which may set up VCS hooks in a git checkout. No credential collection, exfiltration, remote payload execution, or runtime attack behavior was confirmed.

Static reason

No blocking static signals were detected.

Trigger

npm prepare lifecycle in a source/git-install or development checkout

Impact

Potential repository hook configuration; no confirmed broader persistence or data impact

Mechanism

Husky VCS-hook setup invocation

Rationale

No concrete malicious behavior is present in inspected published runtime code. The prepare-only Husky invocation remains a policy-defined lifecycle risk, so downgrade to warn rather than block.

Evidence

package.jsondist/index.jspackages/core/dist/index.jspackages/theme-selector/dist/index.jspackages/adapters/tailwind/dist/preset.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json:172 defines a prepare lifecycle command: "husky || true".

@lgtm-hq/turbo-themes@0.29.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code