No confirmed malicious package attack surface. This is a Vite React browser/desktop UI whose minified distribution bundles account for the structural-risk markers.
Static reason
No blocking static signals were detected.
Trigger
Consumer imports and renders the UI in a browser or desktop host.
Impact
The UI can use the consuming application's configured API session at runtime; no install-time execution, remote code loader, persistence, credential harvesting, destructive action, or foreign AI-agent control-surface mutation is established.
Mechanism
Browser `fetch` and `WebSocket` requests to the configured application runtime, plus user-initiated HTTP(S) external links.
Rationale
Read-only inspection resolves the manual review as benign. The package is a packaged NextClaw React UI with source and Vite build artifacts. Its capability signals are runtime browser transport and UI configuration behavior, while the alleged process-execution signal reduces to bundled tool-result presentation text. There are no npm installation hooks, Node execution primitives, filesystem writes, decoded payloads, remote executable payload paths, persistence mechanisms, or package-triggered mutations of Claude/Codex/Cursor/MCP configuration.
Evidence
package.jsonREADME.mdsrc/main.tsxsrc/shared/lib/api/api-base.tssrc/shared/lib/transport/app-client.service.tssrc/shared/lib/transport/local-transport.service.tssrc/shared/lib/transport/remote-transport.service.tssrc/shared/lib/host-capabilities/host-capability.manager.tssrc/shared/lib/api/utils/marketplace.utils.ts