registry / dpdgroup-css / 2.0.0

dpdgroup-css@2.0.0

PoC package for authorized dependency confusion research

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed attack surface is established. The package contains only a minimal manifest and inert entrypoint.

Static reason

No blocking static signals were detected.

Trigger

Importing index.js

Impact

No observed side effects or attack behavior.

Mechanism

Exports an empty object

Rationale

Direct inspection found no install hooks and no executable behavior beyond an inert CommonJS export. The research-oriented description alone is not malicious behavior.

Evidence

package.jsonindex.js

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no lifecycle scripts or dependencies.
index.js only exports an empty object.
No network, filesystem, shell, dynamic execution, or payload files found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 74 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

No findings.