AI Security Review
scanned 3h ago · by lpm-firewall-aiNo confirmed malicious attack surface. The explicit CLI scaffolds plugin files, runs TypeScript compilation on `build`, and creates a local ZIP on `package`.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `propvault-pdk create`, `build`, or `package`.
Impact
Writes scaffold/build artifacts in the current project; no unconsented install-time action or exfiltration is present.
Mechanism
User-invoked project scaffolding, `npx tsc` compilation, and ZIP creation.
Rationale
The scanner signals map to an explicit developer CLI: its only shell execution is `npx tsc` during a user-requested build. The package has no install hook and no concrete malicious behavior in the inspected source.
Evidence
package.jsonbin/pdk-cli.jsdist/index.jsdist/index.d.tsREADME.md
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for block
Evidence against
- `package.json` has only `prepublishOnly`; no install lifecycle hook.
- `dist/index.js` only registers supplied handlers in `globalThis.__propvault_hooks`.
- `bin/pdk-cli.js` actions require explicit `create`, `build`, or `package` commands.
- `create` writes a bounded scaffold under the user-selected working directory.
- No credential harvesting, network request, dynamic payload loading, or persistence code found.
Behavioral surface
ChildProcessFilesystemShell
NoLicense
Source & flagged code
2 flagged · loading sourcebin/pdk-cli.jsView file
9import path from "path";
L10: import { execSync } from "child_process";
L11: import { fileURLToPath } from "url";
High
168try {
L169: execSync("npx tsc", { cwd: workspaceRoot, stdio: "inherit" });
L170: console.log("\x1b[32m✔ TypeScript compilation complete!\x1b[0m");
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/pdk-cli.jsView on unpkg · L168Findings
3 High4 Low
HighChild Processbin/pdk-cli.js
HighShell
HighRuntime Package Installbin/pdk-cli.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowNo License