AI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence against
- package.json has no lifecycle hooks or executable bin.
- index.js only runs network access when a caller invokes query/getObject methods.
- The sole default endpoint is the package-aligned Sui GraphQL URL.
- No filesystem access, environment harvesting, shell execution, eval, or persistence found.
Behavioral surface
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 2.31 KB of source, external domains: sui-mainnet.mystenlabs.com