registry / @stainless-code/codemap / 0.11.4

@stainless-code/codemap@0.11.4

Local codebase intelligence for AI agents — a SQLite index of symbols, imports, and calls. SQL and recipes instead of scanning the tree.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `codemap agents init` with `--mcp`, integration targets, or `--git-hooks`.

Impact

Configures Codemap as an MCP server and may schedule background local indexing after Git events.

Mechanism

User-invoked agent configuration and optional Git-hook setup.

Rationale

The package is not malicious by source evidence, but its explicit command can mutate AI-agent control surfaces and hooks. Per firewall policy this is a warn-level capability, not a publish block.

Evidence

package.jsondist/index.mjsdist/cmd-agents-BtBusgy-.mjsdist/agents-init-_ecFXOIb.mjsdist/cmd-serve-C9I1DmEd.mjs.agents/.cursor/mcp.json.mcp.json.vscode/mcp.json.claude/settings.json.git/hooks/post-commit.git/hooks/post-merge.git/hooks/post-checkout

Decision evidence

public snapshot

@stainless-code/codemap@0.11.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code