registry / stella-ai-cli / 0.0.1-security

stella-ai-cli@0.0.1-security

security holding package

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed attack surface is present in this package version. It is a metadata-only security holding package with no executable entrypoint or lifecycle hook.

Static reason

No blocking static signals were detected.

Trigger

None.

Impact

No package-originated runtime, install-time, network, or filesystem impact established.

Mechanism

No executable package behavior.

Rationale

Direct inspection shows only a minimal manifest and explanatory README, with no code or install/runtime execution path. The current `0.0.1-security` contents are clean despite the README noting a prior malicious release was removed.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` contains only package metadata; no scripts, entrypoints, dependencies, or binary fields.
Package file inventory contains only `package.json` and `README.md`; no executable source or payload files.
`README.md` describes this release as a security holding placeholder.

stella-ai-cli@0.0.1-security

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code