fix: the package in package.json

[orbisai0security]

Summary

Fix high severity security issue in package.json.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	package.json:1

Description: The package.json does not define an explicit 'files' whitelist array, and no .npmignore file is present in the repository. Without these controls, 'npm publish' will include all non-.gitignore'd files in the published package, potentially exposing internal build scripts (scripts/), CI/CD configuration, and any environment files (.env) to all public consumers of the npm package. This is a misconfiguration that could result in credential or secret exposure if any sensitive files are present in the project directory at publish time.

Changes

• package.json

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security