registry / apexcharts / 6.5.0

apexcharts@6.5.0

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A prepare-only development hook setup can install a repository pre-push hook. No credential collection, network exfiltration, or runtime payload execution was found.

Static reason

No blocking static signals were detected.

Trigger

Prepare lifecycle in a Git/local development installation.

Impact

Modifies Git hook behavior for the package checkout; no malicious payload confirmed.

Mechanism

simple-git-hooks configures pre-push to run lint.

Rationale

No concrete malicious behavior was found by source inspection, but the declared prepare-only VCS hook setup warrants a warning under policy.

Evidence

package.jsonsrc/apexcharts.jssrc/modules/license/LicenseEnforcer.jsdist/apexcharts.common.jsdist/apexcharts.esm.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json declares prepare: npx simple-git-hooks
package.json configures a pre-push hook running npm run lint

Evidence against

No preinstall/install/postinstall lifecycle hooks
Source and published entrypoints contain no fetch, XHR, WebSocket, child-process, eval, or environment harvesting
src/apexcharts.js exports a chart class; rendering occurs only after consumer construction/render()
Only relevant external URL is pricing link used by license UI

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 258 file(s), 13.8 MB of source, external domains: apexcharts.com, stackoverflow.com, www.apache.org, www.w3.org

Source & flagged code

2 flagged

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json declares prepare: npx simple-git-hooks

package.jsonView on unpkg

•Published source reference

Medium

Ai Review Evidence

package.json configures a pre-push hook running npm run lint

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json declares prepare: npx simple-git-hooks

package.jsonView on unpkg

•Published source reference

Medium

Ai Review Evidence

package.json configures a pre-push hook running npm run lint

package.jsonView on unpkg

Findings

3 Medium6 Low

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License