registry / @xylex-group/athena / 3.0.0

@xylex-group/athena@3.0.0

Athena JS SDK

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package provides a configured HTTP/WebSocket SDK and an explicit schema-generation CLI.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Consumer API calls or explicit `athena-js generate` command.

Impact

No install-time execution, foreign control-surface mutation, stealth persistence, or unconsented data transfer established.

Mechanism

Configured service requests and user-invoked local code generation.

Rationale

Source inspection supports a normal Athena SDK and explicit generator CLI. Dynamic import and filesystem/environment access are scoped to loading local generator configuration and generating user-requested artifacts, with no concrete malicious chain.

Evidence

package.jsonbin/athena-js.jsdist/index.jsdist/cli/index.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has only `prepublishOnly`; no install lifecycle hook.

@xylex-group/athena@3.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code