registry / @runnerpro/backend / 1.21.14

@runnerpro/backend@1.21.14

A collection of common backend functions

AI Security Review

scanned 13h ago · by lpm-firewall-ai

A source/git install can invoke Husky through the `prepare` lifecycle script, which is a project-local VCS-hook setup risk. Runtime modules implement explicit configured backend integrations; no malicious execution or exfiltration chain was confirmed.

Static reason

No blocking static signals were detected.

Trigger

Installing from source/git or running npm lifecycle preparation; calling exported backend helpers at runtime.

Impact

May create project-local Git-hook infrastructure; runtime helpers access caller-configured credentials and services.

Mechanism

Husky prepare hook plus configured service clients.

Rationale

No concrete malicious chain was found, but the declared `prepare` Husky lifecycle hook meets the policy's non-blocking VCS-hook setup warning boundary. Downgrade to warn rather than block.

Evidence

package.jsonlib/cjs/index.jslib/cjs/googleSheet/index.jslib/cjs/fetch/fetchIA.jslib/cjs/image/reduceSizeImage.jslib/cjs/workout/saveWorkoutAplication.jslib/cjs/image/generateShareMap.js

Network endpoints5

hooks.slack.com/services/apis.garmin.com/training-api/api.mapbox.com/www.googleapis.com/auth/spreadsheets

@runnerpro/backend@1.21.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code