No confirmed malicious attack surface. The SDK performs caller-invoked HTTP API requests; installation and import do not execute network, filesystem, or credential-harvesting behavior.
Static reason
No blocking static signals were detected.
Trigger
Consumer explicitly instantiates the client and calls an API method.
Impact
Normal SDK requests only; no unconsented persistence, exfiltration, or destructive action established.
Mechanism
Caller-configured Axios API client
Rationale
Source is a generated Axios SDK with caller-controlled transport configuration. The included developer hook and Claude permission file are not invoked by package install or import and do not establish a concrete malicious chain.
Evidence
package.jsonindex.jssrc/index.tsdist/index.jsscripts/apply-json-patch-content-type.js.husky/pre-commit.claude/settings.local.json