@devilsdev/rag-pipeline-utils@2.7.1
Composable retrieval-augmented generation (RAG) for Node.js: grounded citations, evaluation, guardrails, hybrid retrieval and a CLI.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe bundle contains undisclosed runtime analytics that captures plugin search queries and periodically sends them to the package registry’s analytics endpoint. Because this occurs only through explicit PluginHub use and targets the package’s own registry, I classify it as suspicious telemetry rather than malicious exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller constructs PluginHub and performs a plugin search; queued events are sent by its periodic flush timer.
Impact
Search terms may disclose user-provided information to the package’s analytics service without a documented consent or opt-out mechanism.
Mechanism
The analytics records the search query and result count, then POSTs queued events to the configured registry’s /analytics endpoint.
AI rationale
The bundle contains undisclosed runtime analytics that captures plugin search queries and periodically sends them to the package registry’s analytics endpoint. Because this occurs only through explicit PluginHub use and targets the package’s own registry, I classify it as suspicious telemetry rather than malicious exfiltration.
Evidence
dist/index.cjs
Network endpoints1
registry.rag-pipeline.dev/analytics
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- PluginHub analytics starts a periodic flush timer when constructed outside test mode.
- The analytics records each plugin search query and result count.
- The analytics POSTs queued events to the configured registry’s /analytics endpoint; the default registry is registry.rag-pipeline.dev.
Evidence against
- The analytics is tied to explicit PluginHub use, and the default endpoint is the package’s own registry.
- The manifest’s prepare and prepublishOnly scripts do not indicate install-time data collection.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.cjsView file
32var getLogLevel = () => {
L33: if (process.env.LOG_LEVEL) {
L34: const level = process.env.LOG_LEVEL.toLowerCase();
...
L258: if (publicKey instanceof crypto.KeyObject) {
L259: keyObject = publicKey.type === "private" ? crypto.createPublicKey(publicKey) : publicKey;
L260: } else if (Buffer.isBuffer(publicKey) && publicKey.length === 32) {
...
L268: } else if (typeof publicKey === "string" && HEX_KEY_RE.test(publicKey)) {
L269: keyObject = rawToKeyObject(Buffer.from(publicKey, "hex"));
L270: } else if (typeof publicKey === "string" && publicKey.includes("-----BEGIN")) {
...
L293: function computeContentDigest({ files = [], baseDir, contents = {} } = {}) {
L294: const root = path.resolve(baseDir || process.cwd());
L295: const entries = /* @__PURE__ */ new Map();
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.cjsView on unpkg · L326597// Reconstruct plugin function
L6598: const pluginFunc = eval('(' + pluginCode + ')');
L6599:
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index.cjsView on unpkg · L659732var getLogLevel = () => {
L33: if (process.env.LOG_LEVEL) {
L34: const level = process.env.LOG_LEVEL.toLowerCase();
...
L258: if (publicKey instanceof crypto.KeyObject) {
L259: keyObject = publicKey.type === "private" ? crypto.createPublicKey(publicKey) : publicKey;
L260: } else if (Buffer.isBuffer(publicKey) && publicKey.length === 32) {
...
L268: } else if (typeof publicKey === "string" && HEX_KEY_RE.test(publicKey)) {
L269: keyObject = rawToKeyObject(Buffer.from(publicKey, "hex"));
L270: } else if (typeof publicKey === "string" && publicKey.includes("-----BEGIN")) {
...
L293: function computeContentDigest({ files = [], baseDir, contents = {} } = {}) {
L294: const root = path.resolve(baseDir || process.cwd());
L295: const entries = /* @__PURE__ */ new Map();
Findings
1 Critical2 High4 Medium7 Low
CriticalManifest Confusionpackage.json
HighObfuscated Payload Loaderdist/index.cjs
HighSemantic Analysis Limitedsrc/cli/commands/plugin-hub/local-commands.js#virtual:normalized:round1
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.cjs
LowWeak Cryptodist/index.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @devilsdev/rag-pipeline-utils@2.7.1.
See all versions of @devilsdev/rag-pipeline-utils for other recorded verdicts.
- Review the evidence and your use of @devilsdev/rag-pipeline-utils@2.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.