brainsmatics@1.1.90
brainsmatics
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a bundled React visualization library with no lifecycle hook or corroborated malicious primitive. The flagged artifact is ordinary component-bundle code, and its network calls are tied to user-facing relative application APIs.
Decision evidence
public snapshot- The manifest contains only development, build, preview, Storybook, MSW, and release commands; it has no install lifecycle hook.
- The scanner-flagged CommonJS artifact begins as a React and React DOM component bundle.
- Browser API calls use a relative application API base and are invoked by UI functionality.
- No install-time execution, self-dependency, shell execution, Node file access, or payload loader was found.
- No credential harvesting, environment-secret collection, persistence, destructive action, or foreign agent-control mutation was found.
- The large bundled files contain browser UI, visualization, image-decoding, and component code; the static fingerprint is not corroborated by malicious behavior.
Source & flagged code
6 flagged · loading sourcePackage contains source files above the normal full-analysis size ceiling.
dist/index-6a055b8b.mjsView on unpkgBrowser API calls use a relative application API base and are invoked by UI functionality.
dist/index-6a055b8b.mjsView on unpkg · L165020A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index-b2c5b5aa.jsFindings
Affected versions and remediation
This report applies to brainsmatics@1.1.90.
See all versions of brainsmatics for other recorded verdicts.
- Review the evidence and your use of brainsmatics@1.1.90 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.