registry  /  @vikukumar/propvault-pdk  /  0.1.5

@vikukumar/propvault-pdk@0.1.5

Plugin Development Kit (PDK) for the PropVault CMS Platform

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The explicit CLI scaffolds plugin files, runs TypeScript compilation on `build`, and creates a local ZIP on `package`.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs `propvault-pdk create`, `build`, or `package`.
Impact
Writes scaffold/build artifacts in the current project; no unconsented install-time action or exfiltration is present.
Mechanism
User-invoked project scaffolding, `npx tsc` compilation, and ZIP creation.
Rationale
The scanner signals map to an explicit developer CLI: its only shell execution is `npx tsc` during a user-requested build. The package has no install hook and no concrete malicious behavior in the inspected source.
Evidence
package.jsonbin/pdk-cli.jsdist/index.jsdist/index.d.tsREADME.md

Decision evidence

public snapshot
AI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • `package.json` has only `prepublishOnly`; no install lifecycle hook.
    • `dist/index.js` only registers supplied handlers in `globalThis.__propvault_hooks`.
    • `bin/pdk-cli.js` actions require explicit `create`, `build`, or `package` commands.
    • `create` writes a bounded scaffold under the user-selected working directory.
    • No credential harvesting, network request, dynamic payload loading, or persistence code found.
    Behavioral surface
    Source
    ChildProcessFilesystemShell
    Supply chainNo supply-chain packaging signals triggered.
    Manifest
    NoLicense
    scanned 2 file(s), 8.99 KB of source

    Source & flagged code

    2 flagged · loading source
    bin/pdk-cli.jsView file
    9import path from "path"; L10: import { execSync } from "child_process"; L11: import { fileURLToPath } from "url";
    High
    Child Process

    Package source references child process execution.

    bin/pdk-cli.jsView on unpkg · L9
    168try { L169: execSync("npx tsc", { cwd: workspaceRoot, stdio: "inherit" }); L170: console.log("\x1b[32m✔ TypeScript compilation complete!\x1b[0m");
    High
    Runtime Package Install

    Package source invokes a package manager install command at runtime.

    bin/pdk-cli.jsView on unpkg · L168

    Findings

    3 High4 Low
    HighChild Processbin/pdk-cli.js
    HighShell
    HighRuntime Package Installbin/pdk-cli.js
    LowNon Install Lifecycle Scripts
    LowScripts Present
    LowFilesystem
    LowNo License