AI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence against
- package.json has no lifecycle scripts or bin entrypoint.
- dist/index.mjs only computes local streak statistics.
- dist/server.mjs uses a SHA-256 key and an explicitly imported cache store.
- No network, shell, eval, environment, credential, or agent-control code was found.
Behavioral surface
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 4.27 KB of source