ui-bridge

No explicit malicious logic (exfiltration, credential theft, or persistence) is visible in this fragment. However, it uses eval on code loaded from the local filesystem (canvas-app/state-manager.js) without integrity controls, which converts any tampering of that file (or the build/workspace supplying it) into full arbitrary code execution. Treat this as a significant supply-chain/sandboxing risk and ensure the loaded file is trusted and integrity-verified (or replace eval with a controlled import/require path).

SUSPICIOUS: purpose is broadly consistent with UI prototyping, but the alias delegates to an unseen local script and an unverified installed skill, so the main issue is transitive trust and missing provenance rather than confirmed malicious behavior.

No explicit malicious logic is visible in the configuration itself, but it establishes an automatic execution sink that runs a Node.js script from a hidden, project-local directory on every UI edit/write event. This is a moderate supply-chain/sideload risk that depends entirely on the integrity and behavior of `.claude/skills/impeccable/scripts/hook.mjs`, which is not provided here.

This package will execute a local JavaScript file (scripts/install.js) during install and expose it as a CLI. There is no explicit evidence in this package.json of remote HTTP dependencies, overridden resolutions, or known malicious URLs, but running install-time JS is a high-risk operation: the install script could read/write files, install additional packages, spawn processes, create git hooks, exfiltrate data, or open a reverse shell. You must inspect scripts/install.js (and any files it requires or downloads) before installing or running the provided CLI. If you cannot review the script, treat this package as untrusted.