registry / hexo-shoka-swiper / 0.1.13

hexo-shoka-swiper@0.1.13

A Slideshow and Cardshow plugin for theme-shoka based on swiper

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The plugin runs during Hexo generation and emits carousel assets into the generated site. It references a version-pinned package CDN for its own browser assets; no malicious behavior is established.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User installs/enables the Hexo plugin and runs Hexo generation or renders its tags.

Impact

Adds carousel HTML/CSS/JS and optional user-supplied media/embed content to the generated site.

Mechanism

Hexo template rendering, asset injection, and browser carousel initialization.

Rationale

Direct inspection shows a conventional Hexo Swiper plugin with generation-time template reads and browser asset injection. No concrete exfiltration, remote payload execution, destructive action, or unauthorized install-time mutation was found.

Evidence

package.jsonindex.jslib/swiper_init.jslib/slider.njklib/swiper.njkjs/swiper.js

Network endpoints1

cdn.jsdelivr.net/npm/hexo-shoka-swiper@0.1.13

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence with false-positive risk.

hexo-shoka-swiper@0.1.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code