registry / theta-sdk-js / 0.0.1-security

theta-sdk-js@0.0.1-security

security holding package

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed attack surface exists in this extracted version. It is an inert holding package with metadata and documentation only.

Static reason

No blocking static signals were detected.

Trigger

No install-time or runtime code is present to trigger.

Impact

No source-backed malicious action identified.

Mechanism

No executable package behavior

Rationale

Direct inspection shows this package version has no executable files, lifecycle hooks, dependencies, or entrypoints. README.md's historical assertion does not establish malicious behavior in the inspected source.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

README.md states this is a security holding package and claims an earlier package was removed.

Evidence against

package.json contains only package metadata; no scripts, bin, or runtime entrypoints.
The package contains only package.json and README.md.
No executable source, dependencies, network endpoints, file access, or install-time hooks are present.

theta-sdk-js@0.0.1-security

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code