registry / @excali-boards/boards-api-client / 1.1.75
@excali-boards/boards-api-client@1.1.75
A simple API client for the Boards API.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install hook runs Prisma client generation, consistent with the bundled generated Prisma client. Runtime requests go to the URL configured by the consumer, and authorization is supplied by the caller; no credential collection or unrelated destination was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Prisma generation runs during install; API requests occur when the consumer invokes the client.
Impact
No malicious behavior was identified in the reviewed install or runtime paths.
Mechanism
Requests use the configured base URL and caller-provided endpoint, body, and optional authorization header.
AI rationale
The install hook runs Prisma client generation, consistent with the bundled generated Prisma client. Runtime requests go to the URL configured by the consumer, and authorization is supplied by the caller; no credential collection or unrelated destination was found.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a Boards API client and its postinstall script runs `prisma generate`.
- The exported entry point re-exports the client modules; no automatic request logic appears in the entry point.
- BoardsManager sends requests to the URL passed to its constructor and only includes authorization when the request caller supplies it.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
CopyleftLicense
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = prisma generate
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgprisma/generated/libquery_engine-debian-openssl-3.0.x.so.nodeView file
•path = prisma/generated/libquery_engine-debian-openssl-3.0.x.so.node
kind = native_binary
sizeBytes = 17539352
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
prisma/generated/libquery_engine-debian-openssl-3.0.x.so.nodeView on unpkgprisma/generated/query_engine_bg.wasmView file
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltaprisma/generated/runtime/library.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprisma/generated/libquery_engine-debian-openssl-3.0.x.so.node
MediumShips Wasm Moduleprisma/generated/query_engine_bg.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @excali-boards/boards-api-client@1.1.75.
See all versions of @excali-boards/boards-api-client for other recorded verdicts.
- Review the evidence and your use of @excali-boards/boards-api-client@1.1.75 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.