AI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence against
- package.json has no lifecycle scripts or bin entry.
- index.mjs only computes streak statistics from caller-supplied entries.
- server.mjs is activated only by explicit ./server import.
- No network, shell, dynamic-code, credential, or agent-control operations found.
Behavioral surface
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 2.91 KB of source