registry / seediment / 0.1.3

seediment@0.1.3

Keeps your server tidy and gives you a map of it — built for the mess AI coding agents leave behind.

AI Security Review

scanned 6h ago · by lpm-firewall-ai

No confirmed malicious behavior exists in the inspectable JavaScript. The user-invoked CLI delegates all functionality to an unavailable opaque native binary from an optional platform package.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the `seediment` CLI after installation.

Impact

The native payload could act with the invoking user's permissions, but its behavior cannot be verified from this package source.

Mechanism

Platform-specific opaque native binary execution via `execFileSync`.

Rationale

The inspectable package is an inert launcher, but it intentionally carries execution to uninspectable native payloads. Warn rather than block because activation is user-invoked and no concrete malicious chain or lifecycle abuse is present.

Evidence

package.jsonbin/seediment.cjsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

`bin/seediment.cjs` resolves and synchronously executes an opaque platform-specific binary.
`package.json` declares four optional `@seediment/*` platform packages that are not present for inspection.

seediment@0.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code