AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
- `bin/git-user.js` executes a platform-native binary when the user invokes `git-user`.
- Bundled binary strings reference Git/SSH configuration operations and an explicit release-update endpoint.
Evidence against
- `package.json` has no install, postinstall, or preinstall hook; `prepublishOnly` is publisher-time only.
- `bin/git-user.js` only selects an included platform binary and forwards user CLI arguments.
- No source-level credential harvesting, exfiltration, dynamic payload loading, eval, or AI-agent config mutation was found.
- `README.md` describes user-invoked Git identity and SSH-key management consistent with the binary symbols.
- The only concrete embedded API URL is GitHub Releases for the documented `--update` command.
Behavioral surface
SourceChildProcessFilesystem
Supply chainHighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 2.09 KB of source