AI called this Clean at 99.0% confidence as Benign with low false-positive risk.
Evidence for block
- package.json declares postinstall, but its target is absent.
Evidence against
- package.json postinstall targets nonexistent dist/config.js.
- All shipped JS implements local money parsing, arithmetic, allocation, and formatting.
- No network, filesystem, process, shell, dynamic-code, or environment access found.
- dist entrypoint only imports local helper modules.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 10 file(s), 13.2 KB of source