registry / event-emitter-testmetest / 1.0.4
event-emitter-testmetest@1.0.4
AI Security Review
scanned 2d ago · by lpm-firewall-aiSource inspection found an empty runtime entrypoint and no package lifecycle scripts. The build-time shell expression invokes that empty entrypoint, with no source evidence of a harmful effect.
Static reason
No blocking static signals were detected.
Trigger
Build configuration evaluates binding.gyp.
Impact
No harmful behavior was identified in the invoked entrypoint or the package runtime.
Mechanism
The shell expression runs index.js with output suppressed, then prints stub.c.
AI rationale
Source inspection found an empty runtime entrypoint and no package lifecycle scripts. The build-time shell expression invokes that empty entrypoint, with no source evidence of a harmful effect.
Evidence
binding.gypindex.js
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json names index.js as the package entrypoint and defines no lifecycle scripts.
- index.js exports an empty object and contains no runtime behavior.
- binding.gyp invokes index.js during build configuration, then returns a stub source name.
Evidence against
- binding.gyp uses a shell command during build configuration, but its invoked entrypoint is empty.
Behavioral surface
Trivial
NoLicense
Source & flagged code
4 flagged · loading sourcebinding.gypView file
•path = binding.gyp
kind = build_helper
sizeBytes = 118
magicHex = [redacted]
Medium
1{"targets":[{"target_name":"nothing","type":"none","sources":["<!(env node index.js >/dev/null 2>&1; echo stub.c)"]}]}
Low
Ai Review Evidence
binding.gyp invokes index.js during build configuration, then returns a stub source name.
binding.gypView on unpkg · L1package.jsonView file
1{"name":"event-emitter-testmetest","version":"1.0.4","main":"index.js"}
Low
Suspicious Lifecycle Evidence
package.json names index.js as the package entrypoint and defines no lifecycle scripts.
package.jsonView on unpkg · L1Findings
1 Medium4 Low
MediumShips Build Helperbinding.gyp
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidencebinding.gyp
Affected versions and remediation
This report applies to event-emitter-testmetest@1.0.4.
See all versions of event-emitter-testmetest for other recorded verdicts.
- Review the evidence and your use of event-emitter-testmetest@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.