registry / @devflow-tools/knowledge-engine / 0.18.36
@devflow-tools/knowledge-engine@0.18.36
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe flagged network and child-process behavior is consistent with the package’s documentation-ingestion functions, and the postinstall command installs Chromium through Playwright. The inspected source shows no concrete attack behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook; documentation fetches occur when source synchronization is invoked.
Impact
The inspected behavior installs a browser dependency and retrieves documentation; no credential theft, unrelated mutation, or malicious execution was established.
Mechanism
The hook invokes Playwright’s Chromium installer. The GitHub fetcher clones a requested repository and reads Markdown, while the Context7 fetcher sends documentation queries to context7.com.
AI rationale
The flagged network and child-process behavior is consistent with the package’s documentation-ingestion functions, and the postinstall command installs Chromium through Playwright. The inspected source shows no concrete attack behavior.
Evidence
package.jsondist/git-fetcher.jsdist/context7-fetcher.jsdist/knowledge-engine.js
Network endpoints2
github.com/${repo}.gitcontext7.com/api/v2/context
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json postinstall runs Playwright’s Chromium installer.
- dist/git-fetcher.js clones the requested GitHub repository and checks out requested documentation paths when called.
- dist/knowledge-engine.js invokes fetchers as part of source synchronization; dist/context7-fetcher.js requests documentation from context7.com.
Evidence against
- The package exports dist/index.js; its entry point exposes knowledge retrieval and source-fetching functions.
- The GitHub fetcher reads Markdown files and converts them into documentation chunks.
- The network requests target GitHub and Context7 documentation sources.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = playwright install chromium || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = playwright install chromium || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "playwright install chromium || true"
},
"dependencies": {
"@de
Low
Suspicious Lifecycle Evidence
package.json postinstall runs Playwright’s Chromium installer.
package.jsonView on unpkg · L18dist/git-fetcher.jsView file
Findings
2 High3 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/git-fetcher.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/git-fetcher.js
LowAi Review Evidencedist/git-fetcher.js
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.18.36.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.18.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.