registry / rp2350js / 1.0.2

rp2350js@1.0.2

Raspberry Pi Pico (2) emulator. Develop/test/debug RP2040/2350 projects on your PC/in your CI stack. Includes a GDB interface, an MCP server, and the rp2_emu CLI + background daemon for agent-driven firmware debugging.

AI Security Review

scanned 14h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The prepare hook can set up project-local Husky hooks when its lifecycle runs; the CLI can start a user-invoked local emulator daemon.

Static reason

One or more suspicious static signals were detected.

Trigger

npm prepare lifecycle; explicit rp2_emu command

Impact

Project-local VCS hook setup and temporary runtime socket/state files

Mechanism

Husky setup and local Unix-socket daemon

Rationale

No exfiltration, remote payload execution, or foreign AI-agent configuration mutation is present. Per policy, the prepare-only VCS-hook setup warrants a warning despite otherwise package-aligned behavior.

Evidence

package.jsondist/cjs/rp2-emu-cli/rp2-emu.jsdist/cjs/rp2-emu-cli/daemon.jsdist/cjs/rp2-emu-cli/protocol.jsdist/cjs/utils/time.jsdist/cjs/utils/emulator-controller.js

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Benign with medium false-positive risk.

Evidence for warning

package.json declares prepare: husky install.
dist/cjs/rp2-emu-cli/rp2-emu.js can detach a daemon after an explicit CLI command.

rp2350js@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code