registry / kartyk-github-token-pkg / 1.0.2

kartyk-github-token-pkg@1.0.2

Throwaway token-published package for validating malware remove-versions / bulk-remove-versions / rm-scope-packages behavior on the public npm registry.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Installing or requiring this package does not run install hooks or reach the network. The only runtime path returns a hardcoded string.

Static reason

No blocking static signals were detected.

Trigger

Installing the package or requiring index.js.

Impact

No confirmed credential theft, persistence, or remote execution.

Mechanism

String-returning CommonJS export with no side effects

AI rationale

Source inspection of package.json, index.js, and README.md shows no lifecycle mutation, harvesting, or exfiltration. The package is a no-op export plus documentation.

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest lists only a test echo script and no preinstall, install, or postinstall hooks.
The main entry exports a function that returns a hardcoded package name string.

Evidence against

The three package files contain no network calls, child processes, dynamic evaluation, environment reads, or file I/O.
The README describes a throwaway registry takedown fixture and does not add executable behavior.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 99 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-13json

2 "name": "kartyk-github-token-pkg",

3 "version": "1.0.2",

4 "description": "Throwaway token-published package for validating malware remove-versions / bulk-remove-versions / rm-scope-packages behavior on the public npm registry.",

5 "license": "ISC",

6 "author": "kartyk-github",

7 "type": "commonjs",

8 "main": "index.js",

9 "scripts": {

10 "test": "echo \"Error: no test specified\" && exit 1"

11 }

Low

Suspicious Lifecycle Evidence

The manifest lists only a test echo script and no preinstall, install, or postinstall hooks.

package.jsonView on unpkg · L9

12}

index.jsView file

Lines 1-6javascript

1'use strict'

3module.exports = function throwawayTokenPkg() {

4 return 'kartyk-github-token-pkg'

Low

Ai Review Evidence

The main entry exports a function that returns a hardcoded package name string.

index.jsView on unpkg · L3

Source & flagged code

2 flagged · loading source

package.jsonView file

9"scripts": { "test": "echo \"Error: no test specified\" && exit 1" }

Low

Suspicious Lifecycle Evidence

The manifest lists only a test echo script and no preinstall, install, or postinstall hooks.

package.jsonView on unpkg · L9

index.jsView file

3module.exports = function throwawayTokenPkg() { return 'kartyk-github-token-pkg' }

Low

Ai Review Evidence

The main entry exports a function that returns a hardcoded package name string.

index.jsView on unpkg · L3

Findings

3 Low

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceindex.js

Affected versions and remediation

This report applies to kartyk-github-token-pkg@1.0.2.

See version security history for other recorded verdicts.

Review the evidence and your use of kartyk-github-token-pkg@1.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-18 03:19:15.316Z (UTC).