registry / typeglish / 0.2.0

typeglish@0.2.0

The TypeGlish language + compiler — turn English into logically consistent, checkable programs for LLMs.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface. The package includes an explicit Claude hook command that can gate configured prompt-deployment tools, while normal build operations write package-owned `.typeglish` artifacts.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Lifecycle `prepare` invokes Husky; agent gating requires an explicit `typeglish claude-hook` invocation.

Impact

Potential VCS-hook setup during prepare; no confirmed exfiltration, remote execution, persistence, or foreign AI-agent configuration write.

Mechanism

Prepare-time Husky setup plus explicit, local agent-tool payload validation.

Rationale

No concrete malicious chain was found by direct source inspection. Per policy, the prepare-time Husky hook setup remains a lifecycle risk warranting a warning rather than a block.

Evidence

package.jsondist/cli.jsdist/mcp.jsdist/chunk-A2R4ZEV7.js.typeglish/dist/<name>.txt.typeglish/build-manifest.json.typeglish/deploy-gate.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json: `prepare` runs `husky || true`, a lifecycle VCS-hook setup attempt.
dist/cli.js: `claude-hook` can deny configured agent-tool writes when explicitly invoked.

Evidence against

package.json has no preinstall/install/postinstall hook.
dist/cli.js only writes build outputs and manifests under `.typeglish/` after explicit `build`.
dist/cli.js hook reads stdin/files/env but contains no network or subprocess execution.
dist/mcp.js exposes stdio MCP check/build tools; path mode writes only requested project artifacts.
No bidi/invisible Unicode controls were found in distributed `.js` files.
No runtime HTTP client calls were found in package code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 2.06 MB of source, external domains: api.anthropic.com, api.example.com, api.openai.com, generativelanguage.googleapis.com, github.com, json-schema.org, peggyjs.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

2 flagged

dist/chunk-KRYC4OTL.jsView file

Lines 226-266javascript

226 if (zoneMask[i] === true && !tagCol.has(i)) continue;

227 if (toolMask[i] === true && !/^\s*\$(?:TOOL|SERVICE)\b/i.test(raw)) continue;

228 if (swMask[i] === true && !chainStarts.has(i)) continue;

229 if (t.startsWith("//") || t.startsWith("/*") || t.startsWith("*")) continue;

230 const leadWs = (raw.match(/^[ \t]*/) ?? [""])[0];

231 if (leadWs.includes(" ")) continue;

232 col[i] = tagCol.get(i) ?? baseCol[i] ?? 0;

233 substep[i] = /^(?:[a-z]\.|\d+(?:\.\d+)+\.?)\s/i.test(t);

234 }

235 return { col, substep };

236}

237

238// src/core/charset.ts

239var BOUND = Object.fromEntries(

240 COMPARISON_SYMBOLS.flatMap((c) => c.bound ? c.symbols.map((s) => [s, c.bound]) : [])

241);

242var CHARSET_RULES = [

243 // Emoji first, as full ZWJ sequences, so a joiner inside one is never re-flagged as an invisible.

244 // ©®™ are Extended_Pictographic but meaning-bearing marks, not decoration — excluded.

245 {

246 re: /(?![©®™])\p{Extended_Pictographic}(?:️)?(?:‍(?![©®™])\p{Extended_Pictographic}(?:️)?)*/gu,

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-KRYC4OTL.jsView on unpkg · L246

247 source: "structure/special-character",

248 msg: "Emoji is outside the language: the instruction plane is checkable English, and models mirror prompt decoration into output. Remove it, or demonstrate it inside <examples>."

249 },

250 // En-dash between digits is a RANGE — the fix is a hyphen, not a comma.

251 {

252 re: /(?<=\d) ?– ?(?=\d)/g,

253 source: "structure/em-dash",

254 msg: "Typographic dash in a range: write a plain hyphen (3-5). The en-dash is a lookalike the parsers do not read.",

255 fix: () => ({ title: '\u2192 "-"', replacement: "-" })

256 },

257 {

258 re: / ?[—–] ?/g,

259 source: "structure/em-dash",

260 msg: "An em-dash splices two statements into one line: the checker reads one unparseable blob, and models mirror the tic (the canonical AI-tell). Split the statements, or use a comma or colon.",

261 fix: (m, text) => (m.index ?? 0) > 0 && (m.index ?? 0) + m[0].length < text.length ? { title: '\u2192 ","', replacement: ", " } : null

262 },

263 {

264 re: /[“”„]/g,

265 source: "structure/curly-quote",

266 msg: 'A curly quote is not a TG string literal: only straight " binds an utterance, so this text is invisible to the quote doctrine. Straighten it.',

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-KRYC4OTL.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-KRYC4OTL.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/chunk-KRYC4OTL.jsView file

246contains invisible/control Unicode U+200D (zero width joiner) re: /(?![©®™])\p{Extended_Pictographic}(?:️)?(?:<U+200D>(?![©®™])\p{Extended_Pictographic}(?:️)?)*/gu,

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-KRYC4OTL.jsView on unpkg · L246

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-KRYC4OTL.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-KRYC4OTL.jsView on unpkg

Findings

2 Critical3 Medium6 Low

CriticalTrojan Source Unicodedist/chunk-KRYC4OTL.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-KRYC4OTL.js

MediumDynamic Require

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-KRYC4OTL.jsView file

Lines 226-266javascript

226 if (zoneMask[i] === true && !tagCol.has(i)) continue;

227 if (toolMask[i] === true && !/^\s*\$(?:TOOL|SERVICE)\b/i.test(raw)) continue;

228 if (swMask[i] === true && !chainStarts.has(i)) continue;

229 if (t.startsWith("//") || t.startsWith("/*") || t.startsWith("*")) continue;

230 const leadWs = (raw.match(/^[ \t]*/) ?? [""])[0];

231 if (leadWs.includes(" ")) continue;

232 col[i] = tagCol.get(i) ?? baseCol[i] ?? 0;

233 substep[i] = /^(?:[a-z]\.|\d+(?:\.\d+)+\.?)\s/i.test(t);

234 }

235 return { col, substep };

236}

237

238// src/core/charset.ts

239var BOUND = Object.fromEntries(

240 COMPARISON_SYMBOLS.flatMap((c) => c.bound ? c.symbols.map((s) => [s, c.bound]) : [])

241);

242var CHARSET_RULES = [

243 // Emoji first, as full ZWJ sequences, so a joiner inside one is never re-flagged as an invisible.

245 {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-KRYC4OTL.jsView on unpkg · L246

247 source: "structure/special-character",

248 msg: "Emoji is outside the language: the instruction plane is checkable English, and models mirror prompt decoration into output. Remove it, or demonstrate it inside <examples>."

249 },

250 // En-dash between digits is a RANGE — the fix is a hyphen, not a comma.

251 {

252 re: /(?<=\d) ?– ?(?=\d)/g,

253 source: "structure/em-dash",

254 msg: "Typographic dash in a range: write a plain hyphen (3-5). The en-dash is a lookalike the parsers do not read.",

255 fix: () => ({ title: '\u2192 "-"', replacement: "-" })

256 },

257 {

258 re: / ?[—–] ?/g,

259 source: "structure/em-dash",

260 msg: "An em-dash splices two statements into one line: the checker reads one unparseable blob, and models mirror the tic (the canonical AI-tell). Split the statements, or use a comma or colon.",

261 fix: (m, text) => (m.index ?? 0) > 0 && (m.index ?? 0) + m[0].length < text.length ? { title: '\u2192 ","', replacement: ", " } : null

262 },

263 {

264 re: /[“”„]/g,

265 source: "structure/curly-quote",

266 msg: 'A curly quote is not a TG string literal: only straight " binds an utterance, so this text is invisible to the quote doctrine. Straighten it.',

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-KRYC4OTL.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-KRYC4OTL.jsView on unpkg