registry / @tuanhuydev/localcode / 0.3.0

@tuanhuydev/localcode@0.3.0

**The blazingly fast, air-gapped, zero-bloat coding assistant.**

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit `localcode setup` creates this package's own local assistant templates under `~/.localcode`. Model downloads occur only after an interactive user selection; no confirmed malicious or covert surface was found.

Static reason

No blocking static signals were detected.

Trigger

User runs `localcode setup` or selects a model download.

Impact

Creates localcode-owned configuration files and stores user-selected model files.

Mechanism

user-invoked local agent-template setup and model download

Rationale

This is not malicious, but its explicit command provisions a first-party local agent extension surface. Policy treats that setup capability as a warn-level lifecycle risk absent a malicious chain.

Evidence

package.jsondist/cli.jsdist/setup.jsdist/model.jsdist/hooks/useChat.jsdist/hardware.js~/.localcode/skills/scan-codebase.md~/.localcode/agents/code-reviewer/agent.md~/.localcode/models~/.localcode/hardware.json

Network endpoints4

hf:Qwen/Qwen2.5-Coder-7B-Instruct-GGUF:Q4_K_Mhf:Qwen/Qwen2.5-Coder-1.5B-Instruct-GGUF:Q4_K_M

@tuanhuydev/localcode@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code