registry / norma-scope / 0.6.0

norma-scope@0.6.0

Compare your implementation screenshots against Figma designs with a zero-friction, local pre-commit report.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

No confirmed malicious attack surface. User-invoked commands perform package-aligned Figma screenshot comparison, local report generation, and optional project setup.

Static reason

No blocking static signals were detected.

Trigger

User runs the `norma` CLI; hook setup occurs only through interactive `norma init`.

Impact

Reads a user-supplied Figma token for Figma requests and writes local `.bridge` artifacts; explicit init can replace the project pre-commit hook after backing it up.

Mechanism

Figma API access and local visual-regression workspace management.

Rationale

The observable privileged behavior is explicit, user-invoked project setup and Figma comparison. Source inspection found no install-time execution or concrete malicious/exfiltration chain.

Evidence

package.jsonbin/bridge.jsdist/index.jsdist/init.jsdist/env.jsdist/figma.jsdist/report.jsdist/clean.js

Network endpoints2

api.figma.com/v1api.figma.com/v1/me

Decision evidence

public snapshot

norma-scope@0.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code