registry / @tanstack/intent / 0.3.3

@tanstack/intent@0.3.3

Ship compositional knowledge for AI coding agents alongside your npm packages

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `intent hooks install`.

Impact

Can alter Codex/Claude/Copilot behavior by denying edit actions within the selected project or user scope.

Mechanism

Explicit agent-hook configuration and local gate-script installation.

Rationale

Not malicious: source shows no automatic installation, exfiltration, remote payload execution, or destructive behavior. Flag as warning because explicit installation can modify AI-agent control surfaces and gate edits.

Evidence

package.jsondist/cli.mjsdist/command-C7-B6-UW.mjsdist/command-D9HjboSA.mjsdist/staleness-DAcV0ARw.mjs.codex/hooks.json.claude/settings.json.copilot/hooks/hooks.json.intent/hooks/intent-codex-gate.mjs.tanstack/intent/hooks/intent-codex-gate.mjs

Network endpoints1

registry.npmjs.org/

@tanstack/intent@0.3.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code