@copilotkit/runtime@1.70.3
<img src="https://github.com/user-attachments/assets/0a6b64d9-e193-4940-a3f6-60334ac34084" alt="banner" style="border-radius: 12px; border: 2px solid #d6d4fa;" />
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe static signals resolve to normal runtime integrations, fixed imports, and explicitly invoked request handlers. The manifest has no install lifecycle hooks and the inspected code showed no concrete malicious behavior.
Decision evidence
public snapshot- No npm install lifecycle hook is declared; listed scripts are development and validation commands.
- The flagged LangGraph entry uses fixed local and package imports, not a computed module load.
- The annotation path handles an application POST after resolving an authenticated Intelligence user.
- Cloud guardrail traffic is initiated during a runtime request and uses the supplied public API key.
- No install-time execution, self-dependency, shell execution, filesystem harvesting, or AI-agent configuration mutation was found.
- Environment variables configure runtime provider credentials and service endpoints; they are not collected or sent to unrelated hosts.
Source & flagged code
3 flaggedPackage source references dynamic require/import behavior.
dist/langgraph.cjsView on unpkg · L1Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/v2/runtime/handlers/intelligence/annotate.cjsView on unpkg · L6Findings
Affected versions and remediation
This report applies to @copilotkit/runtime@1.70.3.
See all versions of @copilotkit/runtime for other recorded verdicts.
- Review the evidence and your use of @copilotkit/runtime@1.70.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.