registry / @devilsdev/rag-pipeline-utils / 3.0.2
@devilsdev/rag-pipeline-utils@3.0.2
Composable retrieval-augmented generation (RAG) for Node.js: grounded citations, evaluation, guardrails, hybrid retrieval and a CLI.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed source does not show an automatic credential redirect or hidden payload loader. Registry requests use a configured URL, and dynamic evaluation is part of the explicit plugin sandbox workflow.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer configures a plugin registry and explicitly invokes hub operations, or requests plugin installation or execution.
Impact
No automatic credential redirection or unrelated execution was established.
Mechanism
Hub requests use the configured registry URL; plugin evaluation occurs through the sandbox plugin path.
AI rationale
The reviewed source does not show an automatic credential redirect or hidden payload loader. Registry requests use a configured URL, and dynamic evaluation is part of the explicit plugin sandbox workflow.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports its library through dist entry points and exposes its CLI through bin/cli.js.
- PluginHub has no default registry; it requires an explicitly configured registry URL or RAG_PLUGIN_REGISTRY.
- The hub sends its API key to the configured registry URL when making a request; no fixed unofficial gateway appears in that request path.
- Dynamic evaluation in the bundle executes plugin code passed to the sandbox, matching the package’s plugin execution purpose.
Evidence against
- The hub can send a configured API key as a Bearer token, so the configured registry URL determines its recipient.
- Plugin code is dynamically evaluated inside an isolated execution context.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/index.cjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.cjs:
// Authentication/Authorization errors (AUTH_*)
fs.writeFileSync(tmp, JSON.stringify(index));
source: "https://platform.claude.com/docs/en/about-claude/pricing",
"2. Set your API key: `export OPENAI_API_KEY=your-key`",
fs.writeFileSync(
fs.writeFileSync(filePath, content + "\n");
fs.writeFileSync(
`${provider} API key required. Set ${envVar} or pass the apiKey option.`
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.cjsView on unpkg32var getLogLevel = () => {
L33: if (process.env.LOG_LEVEL) {
L34: const level = process.env.LOG_LEVEL.toLowerCase();
...
L258: if (publicKey instanceof crypto.KeyObject) {
L259: keyObject = publicKey.type === "private" ? crypto.createPublicKey(publicKey) : publicKey;
L260: } else if (Buffer.isBuffer(publicKey) && publicKey.length === 32) {
...
L268: } else if (typeof publicKey === "string" && HEX_KEY_RE.test(publicKey)) {
L269: keyObject = rawToKeyObject(Buffer.from(publicKey, "hex"));
L270: } else if (typeof publicKey === "string" && publicKey.includes("-----BEGIN")) {
...
L293: function computeContentDigest({ files = [], baseDir, contents = {} } = {}) {
L294: const root = path.resolve(baseDir || process.cwd());
L295: const entries = /* @__PURE__ */ new Map();
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
Findings
1 Critical3 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltasrc/ecosystem/plugin-hub.js
HighCredential Redirect Persistencedist/index.cjs
HighObfuscated Payload Loaderdist/index.cjs
HighSemantic Analysis Limitedsrc/cli/commands/plugin-hub/local-commands.js#virtual:normalized:round1
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.cjs
LowWeak Cryptodist/index.cjs
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @devilsdev/rag-pipeline-utils@3.0.2.
See all versions of @devilsdev/rag-pipeline-utils for other recorded verdicts.
- Review the evidence and your use of @devilsdev/rag-pipeline-utils@3.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.