AI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence against
- package.json has no lifecycle scripts or bin entrypoint.
- dist/index.mjs only calculates streak statistics.
- dist/internal/streakmath.mjs contains deterministic date/run-length math.
- dist/server.mjs only hashes inputs and memoizes results through its declared cache dependency.
- No network, shell, dynamic execution, credential access, or destructive APIs found in package files.
Behavioral surface
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 4.27 KB of source