registry / @devilsdev/rag-pipeline-utils / 2.6.2
@devilsdev/rag-pipeline-utils@2.6.2
Composable retrieval-augmented generation (RAG) for Node.js: grounded citations, evaluation, guardrails, hybrid retrieval and a CLI.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest and inspected entry points fit the package's RAG and plugin-management purpose. The flagged dynamic evaluation is part of timeout-limited plugin sandboxing, and the reviewed credential path targets Anthropic's own API; no unrelated automatic exfiltration or install-time attack was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Library behavior runs when consumers use its APIs; CLI actions run when invoked.
Impact
No malicious impact identified in the reviewed paths.
Mechanism
The inspected code uses provider credentials for their corresponding API and evaluates plugin code within a timeout-limited isolated VM.
AI rationale
The manifest and inspected entry points fit the package's RAG and plugin-management purpose. The flagged dynamic evaluation is part of timeout-limited plugin sandboxing, and the reviewed credential path targets Anthropic's own API; no unrelated automatic exfiltration or install-time attack was found.
Network endpoints2
api.anthropic.comregistry.rag-pipeline.dev
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package is a RAG utility library; its manifest points to bundled library entry points and a CLI.
- The CLI delegates to the package's command runner, and the inspected plugin installation path is an explicit command.
- The flagged eval reconstructs and runs plugin code inside an isolated VM with a timeout.
- The Anthropic connector reads ANTHROPIC_API_KEY for requests to api.anthropic.com.
Evidence against
- The manifest's prepare script is husky setup, while the install-time scripts identified by the scanner are not present.
- The inspected source shows no automatic credential forwarding to an unrelated host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.cjsView file
32var getLogLevel = () => {
L33: if (process.env.LOG_LEVEL) {
L34: const level = process.env.LOG_LEVEL.toLowerCase();
...
L228: if (publicKey instanceof crypto.KeyObject) {
L229: keyObject = publicKey.type === "private" ? crypto.createPublicKey(publicKey) : publicKey;
L230: } else if (Buffer.isBuffer(publicKey) && publicKey.length === 32) {
...
L238: } else if (typeof publicKey === "string" && HEX_KEY_RE.test(publicKey)) {
L239: keyObject = rawToKeyObject(Buffer.from(publicKey, "hex"));
L240: } else if (typeof publicKey === "string" && publicKey.includes("-----BEGIN")) {
...
L263: function computeContentDigest({ files = [], baseDir, contents = {} } = {}) {
L264: const root = path.resolve(baseDir || process.cwd());
L265: const entries = /* @__PURE__ */ new Map();
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.cjsView on unpkg · L326452// Reconstruct plugin function
L6453: const pluginFunc = eval('(' + pluginCode + ')');
L6454:
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index.cjsView on unpkg · L645232var getLogLevel = () => {
L33: if (process.env.LOG_LEVEL) {
L34: const level = process.env.LOG_LEVEL.toLowerCase();
...
L228: if (publicKey instanceof crypto.KeyObject) {
L229: keyObject = publicKey.type === "private" ? crypto.createPublicKey(publicKey) : publicKey;
L230: } else if (Buffer.isBuffer(publicKey) && publicKey.length === 32) {
...
L238: } else if (typeof publicKey === "string" && HEX_KEY_RE.test(publicKey)) {
L239: keyObject = rawToKeyObject(Buffer.from(publicKey, "hex"));
L240: } else if (typeof publicKey === "string" && publicKey.includes("-----BEGIN")) {
...
L263: function computeContentDigest({ files = [], baseDir, contents = {} } = {}) {
L264: const root = path.resolve(baseDir || process.cwd());
L265: const entries = /* @__PURE__ */ new Map();
Findings
1 Critical2 High4 Medium7 Low
CriticalManifest Confusionpackage.json
HighObfuscated Payload Loaderdist/index.cjs
HighSemantic Analysis Limitedsrc/cli/commands/plugin-hub/local-commands.js#virtual:normalized:round1
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.cjs
LowWeak Cryptodist/index.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @devilsdev/rag-pipeline-utils@2.6.2.
See all versions of @devilsdev/rag-pipeline-utils for other recorded verdicts.
- Review the evidence and your use of @devilsdev/rag-pipeline-utils@2.6.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.