registry / gopydart-core / 1.0.1

gopydart-core@1.0.1

Compilador híbrido GoPyDart puro via NPM

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No unconsented install-time behavior is present. The explicitly invoked compiler executes supplied .pgd code and may load an existing local GoPyDart registry loader.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs pdg start <file> or explicitly imports build/output.js.

Impact

A local .pgd script or pre-existing registry loader can execute with the invoking user's permissions.

Mechanism

User-script compilation with local-loader autoload and shell-command primitive.

Rationale

Not malicious: behavior is activated by explicit user commands and no concrete unconsented attack chain was found. Warn because local-loader autoload, command execution, and the embedded credential create meaningful security risk.

Evidence

package.jsonsrc/CLI/bin.jssrc/core/translator.jssrc/keywords/go.jssrc/CLI/bin2.jsbuild/output.jsBot.pgd

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

src/core/translator.js auto-requires a loader from the user home registry when present.

gopydart-core@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code