AI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence against
- package.json has no lifecycle scripts or bin entrypoint.
- index.mjs only computes streak statistics from supplied entries.
- server.mjs is reached only through the explicit ./server export.
- No network, shell, dynamic execution, credential access, or destructive APIs appear in package source.
- server.mjs caches caller-provided results through its declared dependency store.
Behavioral surface
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 2.89 KB of source