No confirmed malicious attack surface. The package is a React Native UI component kit with static exports and consumer-provided interaction callbacks.
Static reason
No blocking static signals were detected.
Trigger
Importing and rendering exported React Native components.
Impact
No package-originated file access, credential collection, process execution, persistence, or network activity was identified.
Mechanism
UI rendering, theme selection, and callback delegation.
Rationale
Direct source inspection shows a static React Native component library with no lifecycle execution or malicious primitives. The apparent agent-related components only render chat UI and invoke callbacks supplied by the consuming application.
Evidence
package.jsonsrc/index.tssrc/internal/components/MessageToolbar/MessageToolbar.tsxsrc/components/AgentMessage/AgentMessage.tsxdist/commonjs/index.jssrc/internal/utils/resolveMessageCopyText.tssrc/components/UserMessage/UserMessage.tsx