registry / @excali-boards/boards-api-client / 1.1.74
@excali-boards/boards-api-client@1.1.74
A simple API client for the Boards API.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install hook is consistent with the package’s checked-in Prisma schema and writes generated client code to its declared output directory. The flagged authorization flow forwards caller-supplied credentials to the configured API URL; no automatic credential collection or unrelated endpoint was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation runs `prisma generate`; API requests occur when client methods are called.
Impact
No unauthorized data access or transmission was identified in the inspected package source.
Mechanism
Generation targets the package’s Prisma output directory. Requests use the configured API URL and caller-provided authentication.
AI rationale
The install hook is consistent with the package’s checked-in Prisma schema and writes generated client code to its declared output directory. The flagged authorization flow forwards caller-supplied credentials to the configured API URL; no automatic credential collection or unrelated endpoint was found.
Evidence
prisma/generated
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package postinstall runs `prisma generate`, and its schema configures generation into `prisma/generated`.
- The package entry point exports client modules; it shows no automatic network request or credential collection.
- API requests use the configured `this.url` and endpoint, and the Authorization header comes from caller-supplied `data.auth`.
- The Prisma dependency’s preinstall entry invokes a Node-version check.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
CopyleftLicense
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = prisma generate
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgprisma/generated/libquery_engine-debian-openssl-3.0.x.so.nodeView file
•path = prisma/generated/libquery_engine-debian-openssl-3.0.x.so.node
kind = native_binary
sizeBytes = 17539352
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
prisma/generated/libquery_engine-debian-openssl-3.0.x.so.nodeView on unpkgprisma/generated/query_engine_bg.wasmView file
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltaprisma/generated/runtime/library.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprisma/generated/libquery_engine-debian-openssl-3.0.x.so.node
MediumShips Wasm Moduleprisma/generated/query_engine_bg.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @excali-boards/boards-api-client@1.1.74.
See all versions of @excali-boards/boards-api-client for other recorded verdicts.
- Review the evidence and your use of @excali-boards/boards-api-client@1.1.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.