registry / @copilotkit/runtime / 1.79.0

@copilotkit/runtime@1.79.0

AI Security Review

scanned 23d ago · by lpm-firewall-ai

The credential-bearing requests belong to the configured Intelligence client and default to CopilotKit’s service. The manifest has no install hook, and the flagged handler requires an explicitly configured Intelligence runtime.

Static reason

One or more suspicious static signals were detected.

Trigger

An application using the Intelligence client invokes a learned-skills request or the annotation handler.

Impact

The inspected behavior is consistent with authenticated use of the configured service and does not establish credential exfiltration or another attack.

Mechanism

The client authenticates its API request with the project key supplied in its configuration; the annotation handler requires an Intelligence runtime.

AI rationale

Evidence

package.jsondist/v2/runtime/intelligence-platform/client.mjsdist/v2/runtime/intelligence-platform/client.cjsdist/v2/runtime/handlers/intelligence/annotate.cjs

Network endpoints1

api.intelligence.copilotkit.ai

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes runtime entrypoints and defines no install lifecycle hook.
The Intelligence client requires a project API key and defaults to CopilotKit’s Intelligence API; callers may configure the API URL for another deployment.
The learned-skills GET and batch POST requests use the configured client API key, and the CommonJS build mirrors the module build.
The annotation handler requires a CopilotKit Intelligence runtime before handling the request.

Evidence against

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 305 file(s), 1.34 MB of source, external domains: 127.0.0.1, api.cloud.copilotkit.ai, api.intelligence.copilotkit.ai, api.minimax.io, api.unify.ai, copilotkit.resource, docs.copilotkit.ai, generativelanguage.googleapis.com, github.com

Source & flagged code

3 flagged

dist/langgraph.cjsView file

1require("reflect-metadata"); L2: Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/langgraph.cjsView on unpkg · L1

dist/v2/runtime/handlers/intelligence/annotate.cjsView file

6package = @copilotkit/runtime; repositoryIdentity = copilotkit; dependency = @copilotkit/shared L6: const require_resolve_intelligence_user = require('../shared/resolve-intelligence-user.cjs'); L7: let _copilotkit_shared = require("@copilotkit/shared"); L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/v2/runtime/handlers/intelligence/annotate.cjsView on unpkg · L6

package.json

Findings

1 High5 Medium6 Low

HighCopied Package Dependency Bridgedist/v2/runtime/handlers/intelligence/annotate.cjs

MediumDynamic Requiredist/langgraph.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @copilotkit/runtime@1.79.0.

See all versions of @copilotkit/runtime for other recorded verdicts.

Review the evidence and your use of @copilotkit/runtime@1.79.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 00:51:53.927Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @copilotkit/runtime / 1.79.0

@copilotkit/runtime@1.79.0

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

An application using the Intelligence client invokes a learned-skills request or the annotation handler.

Impact

The inspected behavior is consistent with authenticated use of the configured service and does not establish credential exfiltration or another attack.

Mechanism

The client authenticates its API request with the project key supplied in its configuration; the annotation handler requires an Intelligence runtime.

AI rationale

Evidence

package.jsondist/v2/runtime/intelligence-platform/client.mjsdist/v2/runtime/intelligence-platform/client.cjsdist/v2/runtime/handlers/intelligence/annotate.cjs

Network endpoints1

api.intelligence.copilotkit.ai

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes runtime entrypoints and defines no install lifecycle hook.
The Intelligence client requires a project API key and defaults to CopilotKit’s Intelligence API; callers may configure the API URL for another deployment.
The learned-skills GET and batch POST requests use the configured client API key, and the CommonJS build mirrors the module build.
The annotation handler requires a CopilotKit Intelligence runtime before handling the request.

Evidence against

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

Source & flagged code

3 flagged

dist/langgraph.cjsView file

1require("reflect-metadata"); L2: Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/langgraph.cjsView on unpkg · L1

dist/v2/runtime/handlers/intelligence/annotate.cjsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/v2/runtime/handlers/intelligence/annotate.cjsView on unpkg · L6

package.json

Findings

1 High5 Medium6 Low

HighCopied Package Dependency Bridgedist/v2/runtime/handlers/intelligence/annotate.cjs

MediumDynamic Requiredist/langgraph.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @copilotkit/runtime@1.79.0.

See all versions of @copilotkit/runtime for other recorded verdicts.

Review the evidence and your use of @copilotkit/runtime@1.79.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 00:51:53.927Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.