No confirmed malicious attack surface. The explicit CLI scaffolds its bundled templates; runtime fetches support configured application content.
Static reason
No blocking static signals were detected.
Trigger
User runs woodylab-payload init or application invokes its UI features.
Impact
No unconsented installation-time mutation or data exfiltration established.
Mechanism
Template scaffolding and Payload/React UI helpers.
Rationale
Direct inspection found no lifecycle execution beyond prepublishOnly and no concrete malicious behavior. Network and environment references are package-aligned application configuration/features.
Evidence
package.jsondist/cli/init.jsdist/uims/resolver/viewResolver.jsdist/react/components/Form/FormClientWrapper.jsdist/utils/generateCssVars.jsdist/templates/