registry / norma-scope / 0.5.0

norma-scope@0.5.0

Compare your implementation screenshots against Figma designs with a zero-friction, local pre-commit report.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

No install-time attack surface is established. The explicit `norma init` command persists a project-local Git pre-commit hook and Figma configuration.

Static reason

No blocking static signals were detected.

Trigger

User runs `norma init` in a Git project.

Impact

Replaces the repository pre-commit hook, backing up a prior hook when it is not already Norma-managed; later commits run local comparison.

Mechanism

Interactive Figma setup with local report-hook installation.

Rationale

Source inspection found no malicious install/import behavior or unrelated exfiltration. Warn because an explicit setup command overwrites a Git pre-commit hook and stores a token locally, despite being package-aligned and disclosed by its command flow.

Evidence

package.jsonbin/bridge.jsdist/index.jsdist/init.jsdist/figma.jsdist/report.js.git/hooks/pre-commit.git/hooks/pre-commit.pre-norma-backup.env.local.gitignore.bridge/config.json.bridge/screenshots.bridge/reports.bridge/diff

Network endpoints1

api.figma.com/v1

norma-scope@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code