registry / @nemzilla/hydrate / 3.0.1

@nemzilla/hydrate@3.0.1

⚠ Under review

Deterministic event-sourced context harness for AI-assisted engineering (HydrateZ).

Static Scan Results

scanned 20d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 120 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-32json

2 "name": "@nemzilla/hydrate",

3 "version": "3.0.1",

4 "description": "Deterministic event-sourced context harness for AI-assisted engineering (HydrateZ).",

5 "main": "index.js",

6 "type": "commonjs",

7 "bin": {

8 "hydrate": "bin/cli.js",

9 "hz": "bin/cli.js"

10 },

11 "scripts": {

12 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "test": "node --test --experimental-test-coverage test/*.test.js"

14 },

15 "repository": {

16 "type": "git",

17 "url": "git+https://github.com/rnemzek/hydrate.git"

18 },

19 "homepage": "https://github.com/rnemzek/hydrate#readme",

20 "bugs": {

21 "url": "https://github.com/rnemzek/hydrate/issues"

22 },

23 "keywords": [

24 "hydratez",

25 "nemzilla",

26 "ai",

27 "context-harness",

28 "developer-tools",

29 "claude",

30 "claude-code",

31 "gemini",

32 "llm-context",

src/commands/hook.jsView file

Lines 6-46javascript

6// commits/checkouts), so a global git-template hooks dir can't reliably

7// auto-run on a bare `git init`. A shell function wrapping `git` (installed

8// into the user's shell rc) is the deterministic mechanism: it runs after

9// every `git init` regardless of whether the new repo ever gets a commit.

10const BEGIN_MARKER = '# >>> hydrate git hook >>>';

11const END_MARKER =

bin/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3const path = require('path');

4const { scaffoldClaudeCommands } = require('../src/init');

6// npm sets INIT_CWD to the directory `npm install` was actually invoked

src/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function prunedeprecatedcommands(cwd) { const claudecommandsdir = path.join(cwd, '.claude', 'commands'); if (!fs.existssync(claudecommandsdir)) return []; const removed = []; for (const name of fs.readdirsync(claudecommandsdir)) { if (!hydrate_command_name_re.test(name)) continue; if (active_command_names.has(name)) continue; fs.rmsync(path.join(claudecommandsdir, name), { force: true }); removed.push(name); } return removed; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/init.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

@nemzilla/hydrate@3.0.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code