No confirmed malicious attack surface. The package exports data filtering, serialization, grouping, and optional caller-provided async data-source helpers.
Static reason
No blocking static signals were detected.
Trigger
Consumer imports APIs and explicitly invokes them.
Impact
No package-initiated network, persistence, exfiltration, or installation-time behavior established.
Mechanism
In-memory data processing and query-string serialization
Rationale
Source inspection shows a passive data-query utility with no lifecycle execution or concrete malicious behavior. Axios is used only to create cancellation tokens while actual requests are supplied by the consuming application.
Evidence
package.jsondist/index.jssrc/data-source/async-data-source.tssrc/filtering/filter-expression.factory.tssrc/mvc/operators.tssrc/index.ts