No confirmed malicious attack surface. This is a user-invoked API client for invitation CRUD operations.
Static reason
No blocking static signals were detected.
Trigger
Consumer constructs Invitations and calls a public invitation method.
Impact
Only requested invitation API operations are performed; no install-time or import-time side effects found.
Mechanism
Delegates POST/GET/PUT/DELETE requests to @or-sdk/users.
Rationale
Source and compiled entrypoint implement only explicit invitation API methods through a declared dependency. No concrete malicious behavior or lifecycle execution was found.
Evidence
package.jsonsrc/Invitations.tssrc/types.tsdist/cjs/Invitations.jsREADME.md