registry / seediment / 0.1.0

seediment@0.1.0

Keeps your server tidy and gives you a map of it — built for the mess AI coding agents leave behind.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The package is a user-invoked launcher for uninspected native optional-dependency binaries. No install-time behavior or concrete malicious action is visible in the extracted JavaScript source.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the `seediment` CLI.

Impact

The opaque platform binary receives user-supplied arguments; its file, network, and persistence behavior cannot be verified from this package source.

Mechanism

Dynamic platform-binary resolution and direct execution.

Rationale

The visible source is a minimal, user-invoked native-binary loader with no verified malicious behavior, but it delegates all substantive behavior to unavailable opaque binaries. Warn pending inspection of those platform packages rather than block.

Evidence

package.jsonbin/seediment.cjsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

`bin/seediment.cjs` locates and executes an opaque platform binary.
Platform binaries are supplied through `@seediment/*` optional dependencies.
The launcher forwards arbitrary CLI arguments to that binary.

seediment@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code