registry / write-nostr / 0.2.2

write-nostr@0.2.2

Browser-based long-form writing app for the Nostr protocol — NIP-23 editor, feed reader, and publishing tool

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The shipped CLI starts a localhost static server, while deployment actions require an explicit user command and host argument.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the write-nostr binary, npm run tauri:dev, or npm run deploy.

Impact

Intended user-authorized local serving, Nostr publishing, and deployment only; no unconsented package-install action established.

Mechanism

Static SPA serving, Nostr relay communication, and explicit remote deployment.

Rationale

The scanner signals map to a normal static Nostr application, user-invoked Tauri development helper, and explicit SSH deployment script. Direct inspection found no install-time execution or concrete malicious chain.

Evidence

package.jsonscripts/serve.mjsscripts/dev-tauri.mjsscripts/deploy-remote.shscripts/spa-http-server.pybuild/sw.jsbuild/_app/immutable/chunks/Ce_0n3qd.jsbuild/

Network endpoints4

wss://relay.damus.iowss://relay.nostr.bandwss://nos.lolwss://relay.primal.net

write-nostr@0.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code