registry / @where-u/chargeover-nodejs-sdk / 1.0.3

@where-u/chargeover-nodejs-sdk@1.0.3

Unofficial ChargeOver Node.js SDK

AI Security Review

scanned 21h ago · by lpm-firewall-ai

A prepare lifecycle invokes Husky, and the included pre-commit hook invokes lint-staged. Runtime networking is explicit SDK API traffic to a caller-selected ChargeOver URL; no malicious attack chain was confirmed.

Static reason

No blocking static signals were detected.

Trigger

npm prepare lifecycle in a Git checkout; later a user commit triggers the pre-commit hook.

Impact

May configure and run a repository pre-commit hook; SDK requests use credentials supplied by the caller.

Mechanism

VCS hook setup plus caller-configured API client requests

Rationale

No concrete malicious behavior was found, but the declared prepare lifecycle configures a VCS hook. Per policy, prepare-only hook setup is warned rather than blocked.

Evidence

package.json.husky/pre-commitscripts/typecheck.mjsdist/client.jsdist/generated/client/client.gen.jsdist/index.js

Network endpoints1

{instance}.chargeover.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with high false-positive risk.

@where-u/chargeover-nodejs-sdk@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code