matrixflow-js@3.2.2

Dense matrix computation and linear algebra for JavaScript

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Direct inspection found a math library manifest and re-export entrypoint, with no install hooks or source evidence of execution, harvesting, exfiltration, persistence, or destructive behavior.

Static reason

No blocking static signals were detected.

Trigger

User imports the package and invokes its exported math APIs.

Impact

No malicious behavior established.

Mechanism

Local matrix computation and re-exports.

AI rationale

Direct inspection found a math library manifest and re-export entrypoint, with no install hooks or source evidence of execution, harvesting, exfiltration, persistence, or destructive behavior.

Evidence

package.jsonsrc/index.jsmatrix.jsmatrix.mjs

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Manifest has no preinstall, install, or postinstall hook.
Entrypoint only re-exports matrix and decomposition APIs.
Source scan found no filesystem, process, network, shell, eval, or credential-harvesting primitives.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Minified

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 370 KB of source

Source & flagged code

1 flagged

src/index.jsView file

Lines 1-21javascript

1export { AbstractMatrix, default, default as Matrix } from './matrix';

2export * from './symmetricMatrix';

3export * from './distanceMatrix';

4export * from './views/index';

6export { wrap } from './wrap/wrap';

7export { default as WrapperMatrix1D } from './wrap/WrapperMatrix1D';

8export { default as WrapperMatrix2D } from './wrap/WrapperMatrix2D';

10export { solve, inverse } from './decompositions';

11export { determinant } from './determinant';

12export { linearDependencies } from './linearDependencies';

Low

Ai Review Evidence

Entrypoint only re-exports matrix and decomposition APIs.

src/index.jsView on unpkg · L1

13export { pseudoInverse } from './pseudoInverse';

14export { covariance } from './covariance';

15export { correlation } from './correlation';

17export {

18 default as SingularValueDecomposition,

19 default as SVD,

20} from './dc/svd.js';

21export {

Source & flagged code

1 flagged · loading source

src/index.jsView file

1export { AbstractMatrix, default, default as Matrix } from './matrix'; export * from './symmetricMatrix'; export * from './distanceMatrix'; export * from './views/index'; export { wrap } from './wrap/wrap'; export { default as WrapperMatrix1D } from './wrap/WrapperMatrix1D'; export { default as WrapperMatrix2D } from './wrap/WrapperMatrix2D'; export { solve, inverse } from './decompositions'; export { determinant } from './determinant'; export { linearDependencies } from './linearDependencies'; export { pseudoInverse } from './pseudoInverse'; export { covariance } from './covariance'; export

Low

Ai Review Evidence

Entrypoint only re-exports matrix and decomposition APIs.

src/index.jsView on unpkg · L1

Findings

2 Low

LowScripts Present

LowAi Review Evidencesrc/index.js

Affected versions and remediation

This report applies to matrixflow-js@3.2.2.

See all versions of matrixflow-js for other recorded verdicts.

Review the evidence and your use of matrixflow-js@3.2.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-25 15:42:59.705Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.