registry / canary-ci-test / 0.0.1-security

canary-ci-test@0.0.1-security

security holding package

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed attack surface is established. This extracted version is a metadata-only security holding package.

Static reason

No blocking static signals were detected.

Trigger

None.

Impact

No install-time or runtime behavior is defined.

Mechanism

No executable package behavior.

Rationale

Direct source inspection shows a placeholder package with no scripts, entrypoints, dependencies, or executable files. The README's historical claim is not evidence of malicious behavior in this version.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json contains only metadata; no lifecycle scripts or runtime entrypoints.
Package contains only package.json and README.md; no executable, binary, or symlinked payloads.
No network, filesystem, shell, dynamic-loading, or credential-handling code is present.
README.md describes a security holding placeholder but does not execute code.

canary-ci-test@0.0.1-security

AI Security Review

Decision evidence

Source & flagged code

Findings