registry / git-userhub / 3.2.1

git-userhub@3.2.1

Switch Git accounts in one command. No config editing. No SSH key chaos.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface in the inspected JavaScript source. The CLI launcher executes a platform-specific companion binary only when the user invokes git-user; no install-time execution is configured.

Static reason

No blocking static signals were detected.

Trigger

Explicit user invocation of the git-user CLI

Impact

No source-confirmed exfiltration, persistence, destructive action, or foreign control-surface mutation

Mechanism

Platform binary resolution and spawnSync delegation

Rationale

The package is a user-invoked wrapper for platform-specific optional binaries and has no install lifecycle hook. Inspected JavaScript source shows no concrete malicious behavior.

Evidence

package.jsonbin/git-user.jsscripts/build-packages.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hook.
bin/git-user.js only resolves a platform optional dependency and launches its binary after explicit CLI invocation.

git-userhub@3.2.1

AI Security Review

Decision evidence

Source & flagged code

Findings