@nemzilla/hydrate@1.2.1: Clean npm security report (Allow)

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 56.8 KB of source

Source & flagged code

1 flagged

src/setupCc.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const fs = require('fs'); const path = require('path'); const command_content = `--- description: sync the active hydrate uow into context and copy it to the clipboard. --- run \`hydrate prompt --copy\` in the project root using the bash tool, then treat the freshly written \`.hydrate/current_uow.md\` payload as your active lead developer execution scope for this session. `; function runsetupcc() { const cwd = process.cwd(); const commandsdir = path.join(cwd, '.claude', 'commands'); const commandpath = path.join(commands

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/setupCc.jsView on unpkg

Source & flagged code

1 flagged · loading source

src/setupCc.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const fs = require('fs'); const path = require('path'); const command_content = `--- description: sync the active hydrate uow into context and copy it to the clipboard. --- run \`hydrate prompt --copy\` in the project root using the bash tool, then treat the freshly written \`.hydrate/current_uow.md\` payload as your active lead developer execution scope for this session. `; function runsetupcc() { const cwd = process.cwd(); const commandsdir = path.join(cwd, '.claude', 'commands'); const commandpath = path.join(commands

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code