registry / curse-dependent / 0.0.1-security.0

curse-dependent@0.0.1-security.0

security holding package

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed attack surface exists in this extracted version. It contains only metadata and documentation.

Static reason

No blocking static signals were detected.

Trigger

None.

Impact

None observed.

Mechanism

No executable behavior.

AI rationale

Direct inspection found no lifecycle hook, entrypoint, dependency, executable source, or network/file/process behavior. The README's historical claim is not evidence of malicious behavior in this package version.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json has no scripts, dependencies, or executable entrypoints.
Only package files are package.json and README.md.
README.md describes this as a security holding package; no payload is present.

Behavioral surface

SourceNo risky source behavior triggered.

curse-dependent@0.0.1-security.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code