registry / @devflow-tools/knowledge-engine / 0.18.31
@devflow-tools/knowledge-engine@0.18.31
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 26d ago · by lpm-firewall-aiInspected source shows a conventional browser dependency install hook and caller-invoked documentation retrieval. The static hints do not establish malicious behavior, so this package is clean.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs postinstall; documentation fetches require a caller to invoke the relevant exported functions.
Impact
No confirmed malicious impact or credential exposure was established from the inspected code.
Mechanism
Postinstall runs `playwright install chromium || true`. The fetchers retrieve documentation from GitHub or Context7 and process it as Markdown.
AI rationale
Inspected source shows a conventional browser dependency install hook and caller-invoked documentation retrieval. The static hints do not establish malicious behavior, so this package is clean.
Evidence
package.jsondist/git-fetcher.jsdist/context7-fetcher.js
Network endpoints2
context7.com/api/v2/contextgithub.com/${repo}.git
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json’s postinstall runs Playwright’s Chromium installer; no package-authored hook behavior is shown.
- The GitHub fetcher clones a requested repository and checks out requested documentation paths when invoked.
- The Context7 fetcher requests documentation from context7.com when invoked.
Evidence against
- The manifest has no runtime self-dependency and exposes a library entrypoint.
- Inspected network calls retrieve documentation; no credential forwarding or unrelated recipient was found.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = playwright install chromium || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = playwright install chromium || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "playwright install chromium || true"
},
"dependencies": {
"@devflow-tools/provider-runtime": "0.18.31",
"@devflow-tools/sdk": "0.18.31",
"@devflow-t
Medium
Stripped Provenance Metadata
package.json’s postinstall runs Playwright’s Chromium installer; no package-authored hook behavior is shown.
package.jsonView on unpkg · L18Findings
2 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/git-fetcher.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadatapackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/git-fetcher.js
LowAi Review Evidencedist/context7-fetcher.js
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.18.31.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.18.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.