registry / @devflow-tools/knowledge-engine / 0.18.24
@devflow-tools/knowledge-engine@0.18.24
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 26d ago · by lpm-firewall-aiInspected source shows a conventional Playwright browser installation hook and explicit documentation-fetching APIs. No concrete malicious behavior was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation triggers the postinstall command; consumers invoke the exported fetching APIs to retrieve documentation.
Impact
These actions install a browser dependency and retrieve requested documentation; no harmful effect was established.
Mechanism
The postinstall runs Playwright’s Chromium installer. The GitHub fetcher clones the supplied repository into a temporary directory, while the Context7 fetcher requests documentation from Context7.
AI rationale
Inspected source shows a conventional Playwright browser installation hook and explicit documentation-fetching APIs. No concrete malicious behavior was established.
Evidence
package.jsondist/git-fetcher.jsdist/context7-fetcher.jsdist/index.js
Network endpoints2
context7.com/api/v2/contextgithub.com/${repo}.git
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall command runs Playwright’s Chromium installer.
- GitHub fetching is exposed as a function that accepts repository, documentation path, and temporary directory arguments.
- The package exports its Context7 and GitHub fetch functions as APIs.
Evidence against
- No inspected source showed credential harvesting, policy mutation, or covert network transmission.
- The Context7 fetcher uses the Context7 API to retrieve documentation.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = playwright install chromium || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = playwright install chromium || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "playwright install chromium || true"
},
"dependencies": {
"@devflow-tools/provider-runtime": "0.18.24",
"@devflow-tools/sdk": "0.18.24",
"@devflow-t
Low
Suspicious Lifecycle Evidence
The postinstall command runs Playwright’s Chromium installer.
package.jsonView on unpkg · L18dist/git-fetcher.js
Findings
2 High3 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/git-fetcher.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/git-fetcher.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.18.24.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.18.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.