registry / @mat3ra/parsers / 2026.7.4-0

@mat3ra/parsers@2026.7.4-0

Parsers Py/JS

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No malicious payload or exfiltration path was found. The only meaningful lifecycle risk is prepare-time local VCS hook setup via Husky.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the npm prepare lifecycle in a VCS checkout.

Impact

May create/update package-local VCS hook configuration; no confirmed remote execution or data access.

Mechanism

Husky hook installation; postinstall TypeScript compilation.

Rationale

This is a guarded lifecycle-hook risk under policy, not evidence of malware. Source inspection found only a greeting export and a local TypeScript build step.

Evidence

package.jsonsrc/js/index.tstsconfig.json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json: prepare runs `husky install`, which can set up local VCS hooks.
package.json: postinstall automatically invokes the TypeScript compiler.

Evidence against

src/js/index.ts only exports a deterministic `greet` function.

@mat3ra/parsers@2026.7.4-0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code