hexo-shoka-swiper@0.1.18
A Slideshow and Cardshow plugin for theme-shoka based on swiper
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is a Hexo presentation plugin with no install-time execution beyond a development Husky prepare command and no concrete malicious behavior in its active source. Its CDN strings are asset references, not an exfiltration or payload-fetch sink.
Decision evidence
public snapshot- The manifest exposes index.js and has only a prepare hook that invokes Husky; it has no install lifecycle hook.
- The main entry registers a Hexo generation filter and exits unless the user configuration enables the swiper feature.
- No credential access, shell execution, destructive file operation, remote-code loader, or network request sink was found in the entrypoint or its local initialization script.
Source & flagged code
4 flagged · loading sourceA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
index.jsView on unpkgFindings
Affected versions and remediation
This report applies to hexo-shoka-swiper@0.1.18.
See all versions of hexo-shoka-swiper for other recorded verdicts.
- Review the evidence and your use of hexo-shoka-swiper@0.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.