Is kepano/defuddle safe?
https://github.com/kepano/defuddle
kepano/defuddle is a legitimate, security-conscious TypeScript library for web content extraction with an empty SKILL.md and zero LLM attack surface. All canary files remain intact; pre-clone file access events are attributable to the audit monitoring infrastructure rather than the repository. Network activity during installation was limited exclusively to GitHub. The library actively defends against XSS, URL injection, and event handler attacks in its own output pipeline.
Category Scores
Findings (5)
INFO No SKILL.md content 0 ▶
SKILL.md is completely empty. This repository has no LLM agent skill instructions and presents zero prompt injection risk.
LOW Pre-clone canary file reads by audit infrastructure 7 ▶
Six canary files were read in read-only mode approximately 5.5 seconds before the git clone executed. Timing analysis and the official canary integrity check (✅ intact) confirm these accesses are from the monitoring framework's setup phase, not from the repository.
INFO No malicious npm install hooks 0 ▶
package.json contains only standard development scripts. No preinstall, postinstall, or prepare hooks that would execute code on npm install.
INFO Clone connects only to GitHub 0 ▶
The only external network connection observed during clone was to 140.82.121.4:443 (github.com). No unexpected C2, data collection, or exfiltration endpoints contacted.
INFO Active XSS and URL injection defenses in source 0 ▶
The library includes explicit security tests and implementations for blocking javascript: URIs, data: URIs in iframes, blob: URIs, srcdoc attributes, and event handler attributes. It was patched for CVE GHSA-jg4p-g6xj-4qmf. This is a security-responsible codebase.