registry / @siyuan-community/siyuan-sdk / 0.3.16

@siyuan-community/siyuan-sdk@0.3.16

A simple and easy to use SDK for SiYuan.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The prepare lifecycle can install repository Git hooks. Runtime networking is an explicit SiYuan SDK client action, defaulting to localhost.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm prepare lifecycle; consumer calls Client methods.

Impact

Development-repository hook mutation; no confirmed credential theft, remote payload execution, or exfiltration.

Mechanism

Husky hook setup and caller-configured HTTP/WebSocket API client.

Rationale

This is not malicious source, but the packaged prepare hook mutates a VCS control surface and should be warned under the lifecycle policy. Runtime API and filesystem capabilities are explicit SDK functionality directed at the configured SiYuan service.

Evidence

package.json.husky/pre-commit.husky/commit-msgsrc/client/Client.tssrc/constants.ts

Network endpoints1

localhost:6806/

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Benign with low false-positive risk.

@siyuan-community/siyuan-sdk@0.3.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code