@copilotkit/runtime@1.71.2
<img src="https://github.com/user-attachments/assets/0a6b64d9-e193-4940-a3f6-60334ac34084" alt="banner" style="border-radius: 12px; border: 2px solid #d6d4fa;" />
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package exposes a server-side AI runtime with expected configured network calls, but inspection found no malicious execution chain or install hook. Static flags are explained by ordinary runtime imports, provider configuration, and cloud handlers.
Decision evidence
public snapshot- The runtime can post configured guardrail messages and a public API key to its cloud endpoint during a cloud request.
- The intelligence annotation handler accepts a runtime request only after resolving an authenticated intelligence user.
- The manifest includes developer scripts but no npm preinstall, install, or postinstall hook.
- No install-time execution, self-dependency, shell execution, destructive filesystem action, or agent-control-surface mutation was found.
- Network and environment-variable use is tied to configured AI providers, cloud guardrails, and telemetry controls rather than hidden collection.
Source & flagged code
3 flaggedPackage source references dynamic require/import behavior.
dist/langgraph.cjsView on unpkg · L1Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/v2/runtime/handlers/intelligence/annotate.cjsView on unpkg · L6Findings
Affected versions and remediation
This report applies to @copilotkit/runtime@1.71.2.
See all versions of @copilotkit/runtime for other recorded verdicts.
- Review the evidence and your use of @copilotkit/runtime@1.71.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.