AI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence against
- package.json has no lifecycle hooks; only a test script.
- index.js exports a client and does not execute network calls on import.
- Network activity occurs only when a caller invokes query/getObject.
- No filesystem, shell, eval, credential, or persistence code found.
Behavioral surface
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 2.31 KB of source, external domains: sui-mainnet.mystenlabs.com