@trackunit/iris-app-sdk-vite@1.0.54

No blocking static signals were detected.

User invokes the package's Nx build or serve executor; the extension loader is fetched only when the dev server receives /extensionloader.js.

No unconsented install-time execution, credential exfiltration, persistence, destructive action, or remote payload chain is established.

Vite/Nx development and build configuration with package-aligned HTTP fetches.

Source inspection shows a conventional Nx/Vite SDK with explicit executor-triggered behavior. Dynamic requires load user-selected Vite configuration or the app manifest, while network and keychain use are package-aligned development/authentication features without a concrete malicious chain.