[Golevka2001]

Submitted by the publish action from Golevka2001/genius-lyrics. The artifact is downloaded and re-hashed by the validator.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

Verdict: no concerns

genius-lyrics 0.3.1 — verified at Golevka2001/genius-lyrics@12077442. Reviewed the attested source (index.ts, mod.tsx, genius.ts, cache.ts, logic.ts, panel.ts, view.ts), metadata.json, package.json, and bun.lock. The release zip's sha256 matches the vault entry, and the zip's sourcemap sourcesContent is byte-identical to the attested source, so the built output matches what was reviewed. This is a first-time submission, so there is no prior version to diff against.

Findings: none.

• Network: genius.com API plus lyric pages (the module's stated purpose, described in the entry); spclient.wg.spotify.com color-lyrics for same-track timing behind the experimental synced highlight; youtube.com / img.youtube.com thumbnail link cards only when a Genius note itself contains a bare YouTube URL; annotation/author images are Genius-served URLs arriving inside API responses. No other hosts are contacted, and no tokens, cookies, or credentials are read or transmitted anywhere.
• Remote/dynamic code: none — no eval, new Function, remote import(), or injected <script>; remote HTML is reduced to text via regex parsing (logic.ts) and rendered as React text nodes. The only dangerouslySetInnerHTML uses are a hardcoded SVG icon constant (mod.tsx).
• Credentials and internals: no AuthorizationAPI/token access, no daemon token, no 127.0.0.1:7967, no localStorage writes. Genius is fetched via client.cosmos with fallback to client.corsProxy.fetch (genius.ts), with no custom headers and no hardcoded proxy endpoint.
• Loader hang: no unbounded await in the load path — module load only awaits a local static import, every network fetch carries an 8s timeout (cache.ts), and annotation batches use Promise.allSettled with an AbortSignal.
• Supply chain: runtime-dependency-free; dev-only dependencies, no install scripts; built on a GitHub-hosted runner via the standard build-module workflow.

Did not review: stdlib/client internals beyond confirming client.cosmos is CosmosAsync and that all call sites pass no auth headers or bodies; validator CI checks (checksum recomputation, zip-entry safety), which CI covers.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — reviewed the single-file vault submission in this run:

• New genius-lyrics@0.3.1 vault entry — adds vault/genius-lyrics.json with artifact URL, sha256 checksum, and module metadata (app kind, author, repository, license).

  ^{｜ View workflow run ｜ Using muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏}