@ever-gauzy/plugin-integration-plane-api@0.1.7
Ever Gauzy Plane Integration - A Proxy connecting Plane frontend to Ever Gauzy APIs
AI Security Review
scanned 20d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or unrelated credential transfer. Runtime network requests are part of the consumer-invoked proxy and target the configured Gauzy API base.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls the exported proxy mount function and a request reaches its configured proxy path.
Impact
This supports the package’s proxy function; the inspected source shows no unrelated credential recipient or install-time action.
Mechanism
The proxy reads a session token from request cookies and the API client sends it as a bearer token to the configured Gauzy API base.
AI rationale
Source inspection found no install lifecycle hook or unrelated credential transfer. Runtime network requests are part of the consumer-invoked proxy and target the configured Gauzy API base.
Evidence
package.jsondist/index.jsdist/mount.jsdist/modules/api-fetch/api-fetch.service.jsdist/modules/api-fetch/token.middleware.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a compiled entrypoint and lists ordinary build, start, lint, and test scripts; it defines no install lifecycle hook.
- The entrypoint exports the proxy module and bootstrap function; the proxy starts when a consumer calls its mount function.
- The proxy’s Gauzy API base comes from consumer options or the Gauzy API environment setting, with a local API fallback.
- The API client attaches a bearer token to requests sent to the configured API base, and middleware obtains that token from the request’s session cookies.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStrings
CopyleftLicense
Source & flagged code
6 flaggedpackage.jsonView file
26"scripts": {
"build": "nest build",
"format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
"start": "nest start",
"start:dev": "nodemon",
"start:debug": "nest start --debug --watch",
"start:prod": "node dist/main",
"lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
"test": "jest",
"test:watch": "jest --watch",
"test:cov": "jest --coverage",
Low
Suspicious Lifecycle Evidence
The manifest points to a compiled entrypoint and lists ordinary build, start, lint, and test scripts; it defines no install lifecycle hook.
package.jsonView on unpkg · L26dist/index.jsView file
4var main_1 = require("./main");
Object.defineProperty(exports, "bootstrap", { enumerable: true, get: function () { return main_1.bootstrap; } });
var plane_proxy_module_1 = require("./plane-proxy.module");
Object.defineProperty(exports, "PlaneProxyModule", { enumerable: true, get: function () { return plane_proxy_module_1.PlaneProxyModule; } });
va
Low
Ai Review Evidence
The entrypoint exports the proxy module and bootstrap function; the proxy starts when a consumer calls its mount function.
dist/index.jsView on unpkg · L4Findings
2 Medium9 Low
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowCopyleft License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/mount.js
LowAi Review Evidencedist/mount.js
LowAi Review Evidencedist/modules/api-fetch/api-fetch.service.js
LowAi Review Evidencedist/modules/api-fetch/token.middleware.js
Affected versions and remediation
This report applies to @ever-gauzy/plugin-integration-plane-api@0.1.7.
See all versions of @ever-gauzy/plugin-integration-plane-api for other recorded verdicts.
- Review the evidence and your use of @ever-gauzy/plugin-integration-plane-api@0.1.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.