registry / @devflow-tools/knowledge-engine / 0.18.14
@devflow-tools/knowledge-engine@0.18.14
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe postinstall hook is a transparent Playwright browser setup command, and the flagged git code is a bounded sparse documentation clone. Source inspection found no concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation downloads Chromium; callers must invoke documentation sync or fetch APIs for network activity.
Impact
No unconsented data collection, control-surface mutation, or destructive action was found.
Mechanism
Package-aligned browser setup and documentation retrieval.
AI rationale
The postinstall hook is a transparent Playwright browser setup command, and the flagged git code is a bounded sparse documentation clone. Source inspection found no concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Install hook runs Playwright's Chromium installer.
- Git helper invokes git only to sparse-clone configured GitHub documentation paths.
Evidence against
- No self-dependency or hidden lifecycle chain is present.
- Network access is in exported, user-invoked documentation fetch functions.
- No credential harvesting, exfiltration, shell evaluation, agent-control writes, or stealth persistence was found.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = playwright install chromium || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = playwright install chromium || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "playwright install chromium || true"
Low
Suspicious Lifecycle Evidence
Install hook runs Playwright's Chromium installer.
package.jsonView on unpkg · L18dist/git-fetcher.jsView file
Findings
2 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/git-fetcher.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/git-fetcher.js
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.18.14.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.18.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.