registry / @devflow-tools/knowledge-engine / 0.18.38
@devflow-tools/knowledge-engine@0.18.38
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection found an install hook limited to Playwright Chromium setup and exported, source-aligned documentation fetchers. No concrete attack behavior was established, so the package is clean.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation activates the postinstall hook; documentation requests occur when the exported fetch functions are called.
Impact
The hook installs a browser runtime, and user-invoked fetches retrieve documentation. No malicious mutation or credential exposure was established.
Mechanism
The hook runs `playwright install chromium`. The inspected fetchers clone a specified GitHub repository or query the fixed Context7 API and process returned documentation.
AI rationale
Source inspection found an install hook limited to Playwright Chromium setup and exported, source-aligned documentation fetchers. No concrete attack behavior was established, so the package is clean.
Evidence
package.jsondist/git-fetcher.jsdist/context7-fetcher.jsdist/index.js
Network endpoints2
context7.com/api/v2/contextgithub.com/${repo}.git
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json postinstall installs Chromium through Playwright; no additional package-owned install behavior was found in the inspected hook.
- GitHub fetching clones a specified repository and reads Markdown files from requested paths.
- Context7 fetching queries a fixed Context7 API using configured library identifiers and predefined topics.
Evidence against
- The package entrypoint exports the knowledge engine and fetcher APIs; the inspected entrypoint contains no automatic fetch invocation.
- Inspected network behavior is tied to documentation retrieval and the fixed Context7 endpoint; no credential collection or unrelated data transfer was identified.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = playwright install chromium || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = playwright install chromium || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "playwright install chromium || true"
},
"dependencies": {
"@devflow-tools/provider-runtime": "0.18.38",
"@devflow-tools/sdk": "0.18.38",
"@devflow-t
Low
Suspicious Lifecycle Evidence
package.json postinstall installs Chromium through Playwright; no additional package-owned install behavior was found in the inspected hook.
package.jsonView on unpkg · L18Findings
2 High3 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/git-fetcher.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/git-fetcher.js
LowAi Review Evidencedist/context7-fetcher.js
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.18.38.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.18.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.