registry / hexo-theme-hipaper-keyboarddaily / 1.7.2
hexo-theme-hipaper-keyboarddaily@1.7.2
Bugfix for A newspaper theme for Hexo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest contains no lifecycle hooks or runtime dependencies, and inspected network behavior is limited to ordinary theme features. No concrete attack behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A visitor uses the share control or views a site with visitor counting enabled.
Impact
No confirmed harmful effect was established; these features provide ordinary theme functionality.
Mechanism
The theme creates social share links on user interaction and conditionally includes a visitor counting script.
AI rationale
The manifest contains no lifecycle hooks or runtime dependencies, and inspected network behavior is limited to ordinary theme features. No concrete attack behavior was identified.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists theme assets and development dependencies, with no lifecycle scripts or runtime dependencies.
- Social sharing links are created when a visitor clicks the share control; the configuration provides ordinary social links.
- The optional visitor counter loads its counting script only when enabled; its configuration is visible in the theme settings.
Evidence against
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
13"files": [
"layout",
"scripts",
"source",
"languages",
"_config.yml"
],
"devDependencies": {
"grunt": "~1.4.1",
"load-grunt-tasks": "~5.1.0",
"grunt-git": "~0.2.2",
"grunt-contrib-clean": "~1.0.0",
"grunt-contrib-copy": "~1.0.0"
}
}
Low
Suspicious Lifecycle Evidence
package.json lists theme assets and development dependencies, with no lifecycle scripts or runtime dependencies.
package.jsonView on unpkg · L13source/js/script.jsView file
69var html = [
'<div id="' + id + '" class="article-share-box">',
'<input class="article-share-input" value="' + url + '">',
'<div class="article-share-links">',
'<a href="https://twitter.com/intent/tweet?url=' + encodedUrl + '" class="article-share-twitter" target="_blank" title="Twitter"></a>',
'<a href="https://www.facebook.com/sharer
Low
Ai Review Evidence
Social sharing links are created when a visitor clicks the share control; the configuration provides ordinary social links.
source/js/script.jsView on unpkg · L69Findings
1 Medium7 Low
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesource/js/script.js
LowAi Review Evidence_config.yml
LowAi Review Evidencelayout/_partial/busuanzi-analytics.ejs
Affected versions and remediation
This report applies to hexo-theme-hipaper-keyboarddaily@1.7.2.
See all versions of hexo-theme-hipaper-keyboarddaily for other recorded verdicts.
- Review the evidence and your use of hexo-theme-hipaper-keyboarddaily@1.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.