registry / feed-widget-helper / 1.0.3

feed-widget-helper@1.0.3

AI Security Review

scanned 22d ago · by lpm-firewall-ai

No confirmed attack surface. The only network use is same-origin fetch of / and POST to /addPost, with no install hook or foreign endpoint.

Static reason

No blocking static signals were detected.

Trigger

Importing or requiring the package main module.

Impact

No third-party exfiltration, secret theft, or install-time mutation is established.

Mechanism

same-origin fetch and POST of page text

AI rationale

The scanner network finding is only relative fetch calls aligned with a feed helper, not a foreign command-and-control path. With no lifecycle hooks and no harvesting or persistence primitives, the package is clean.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

index.js runs a top-level GET of / and POSTs the response text to /addPost as soon as the module is loaded.

Evidence against

package.json has no preinstall, install, postinstall, bin, or dependency fields.
Network calls use only relative same-origin paths, with no third-party host.
The package has no credential, filesystem, eval, child-process, persistence, or agent-config behavior.

feed-widget-helper@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code