registry / @loopdive/js2 / 0.62.0

@loopdive/js2@0.62.0

Direct AOT compilation from JavaScript and TypeScript to WebAssembly GC

AI Security Review

scanned 6h ago · by lpm-firewall-ai

A prepare lifecycle hook changes the caller repository's Git hook path to `.husky`. No credential exfiltration, remote endpoint, or AI-agent control-surface mutation was confirmed.

Static reason

No blocking static signals were detected.

Trigger

npm prepare lifecycle execution

Impact

Can alter which Git hooks run in the invoking checkout.

Mechanism

local Git hook-path configuration mutation

Rationale

The package is a compiler and its runtime/CLI behavior is package-aligned, but its prepare lifecycle mutates Git hook configuration. Per policy, prepare-only VCS hook setup warrants a warning rather than a block.

Evidence

package.jsondist/cli.jsdist/optimize.jsdist/runtime-D6yybU-Q.jsexamples/native-messaging/README.md.git/config

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Benign with low false-positive risk.

Evidence for warning

package.json: prepare runs `git config core.hooksPath .husky || true`.
The lifecycle command mutates the invoking repository's local Git hook configuration when prepare runs.

@loopdive/js2@0.62.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code