@atrib/annotate

Malware/supply-chain heuristics raised flags — review the signals before trusting this package.

• No malware layer produced data — package not deep-scanned for malware
• Socket.dev feed not consulted (no key, quota, or fetch failure)

Package comes from a trusted publisher with no typosquat signals.

• Published from CI with an SLSA provenance attestation
• 2 runtime dependencies — larger supply-chain attack surface

Only basic API-key auth is configured. OAuth or mTLS is stronger for production.

• Local stdio transport — no network exposure, but authentication cannot be verified from a static scan

Uses local stdio transport (low network exposure) but no wire encryption if exposed remotely.

• Local-only transport — low network exposure, but unencrypted and unsafe to tunnel remotely without TLS

Tool surface is mostly read-only or low risk.

• All tools are read-only — excellent posture

The live probe sent attack payloads but the server returned no clear signals.

• Probe sent 4 attack payload(s) — no clear response signals observed

Live probe responses were clean — no payload reflection or secret leaks observed.

• 4 live probe call(s) showed no payload reflection or secret leaks

Not proxied through Mastyf AI — no runtime policy enforcement or audit trail.

• Policy enforcement not observed — runtime policy and audit layer cannot be verified