registry / @excali-boards/boards-api-client / 1.1.73
@excali-boards/boards-api-client@1.1.73
A simple API client for the Boards API.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install hook runs Prisma client generation for the package’s schema. The flagged credential flow forwards caller-provided auth to the configured API URL, and the inspected entry point does not initiate requests or collect credentials on import.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Prisma generation runs at install; API requests occur when the consuming application calls client methods.
Impact
No malicious impact identified from the inspected source.
Mechanism
The client sends requests to its configured base URL and forwards auth supplied by the caller. No unrelated credential collection or automatic outbound request was found.
AI rationale
The install hook runs Prisma client generation for the package’s schema. The flagged credential flow forwards caller-provided auth to the configured API URL, and the inspected entry point does not initiate requests or collect credentials on import.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook runs `prisma generate`, configured to generate a Prisma client into `prisma/generated` from the package schema.
- The runtime manager sends requests to its constructor-supplied URL plus the requested endpoint; it adds an Authorization header only when the caller supplies `data.auth`.
- The exported entry point re-exports the API client modules; the inspected entry point contains no automatic request or credential collection.
Evidence against
- The package defines an install-time postinstall hook, but its command is Prisma client generation.
- The client handles authentication data, but the inspected flow forwards caller-supplied auth to the caller-configured API URL.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = prisma generate
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgprisma/generated/libquery_engine-debian-openssl-3.0.x.so.nodeView file
•path = prisma/generated/libquery_engine-debian-openssl-3.0.x.so.node
kind = native_binary
sizeBytes = 17539352
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
prisma/generated/libquery_engine-debian-openssl-3.0.x.so.nodeView on unpkgprisma/generated/query_engine_bg.wasmView file
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltaprisma/generated/runtime/library.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprisma/generated/libquery_engine-debian-openssl-3.0.x.so.node
MediumShips Wasm Moduleprisma/generated/query_engine_bg.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @excali-boards/boards-api-client@1.1.73.
See all versions of @excali-boards/boards-api-client for other recorded verdicts.
- Review the evidence and your use of @excali-boards/boards-api-client@1.1.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.