registry / @xylex-group/athena / 2.13.0

@xylex-group/athena@2.13.0

Athena JS SDK

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an Athena SDK with configured HTTP/WebSocket clients and an explicit schema-generator CLI.

Static reason

No blocking static signals were detected.

Trigger

Consumer invokes SDK methods or runs `athena-js generate`.

Impact

No unconsented install-time execution, foreign control-surface mutation, or exfiltration chain established.

Mechanism

Caller-configured service requests and explicit local schema generation.

Rationale

Static inspection shows normal SDK and user-invoked generator behavior, with no malicious install-time or import-time chain. Dynamic import and filesystem access are limited to explicit generator configuration and artifact output.

Evidence

package.jsonbin/athena-js.jsdist/index.jsdist/cli/index.js

Network endpoints1

athena-db.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.js` uses `new Function` solely to dynamically import a user-selected generator config.

@xylex-group/athena@2.13.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code