registry / @xylex-group/athena / 3.0.2

@xylex-group/athena@3.0.2

Athena JS SDK

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime gateway calls target the SDK's configured or default Athena endpoint only when application APIs are invoked.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Application SDK calls or explicit `athena-js generate` invocation.

Impact

No unconsented install-time execution, credential harvesting, persistence, or destructive action confirmed.

Mechanism

User-invoked SDK gateway requests and schema generation.

Rationale

The flagged dynamic import and filesystem writes are confined to the explicit generator workflow, while network and session-header handling implement the advertised Athena SDK gateway/auth behavior. Source inspection found no concrete malicious chain or lifecycle-triggered action.

Evidence

package.jsonbin/athena-js.jsdist/index.jsdist/cli/index.jsdist/next/server.jsdist/next/client.js

Network endpoints1

mirror2.athena-cluster.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with false-positive risk.

@xylex-group/athena@3.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code