registry / @grantjs/server / 1.18.4
@grantjs/server@1.18.4
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 11d ago · by lpm-firewall-aiStatic source inspection found no install hook or attack behavior. Request credentials are forwarded as part of authorization checks to the configured Grant API, and the required dependency contains schema and type exports.
Static reason
No blocking static signals were detected.
Trigger
A consumer invokes an authorization check through the client or a framework integration.
Impact
The inspected behavior supports the package’s authorization function; no unrelated data transfer or system modification was identified.
Mechanism
The client sends the requested permission and current request credentials to the configured API URL for authorization.
AI rationale
Static source inspection found no install hook or attack behavior. Request credentials are forwarded as part of authorization checks to the configured Grant API, and the required dependency contains schema and type exports.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the dist entrypoints and lists no install lifecycle hooks.
- The pinned @grantjs/schema dependency has no install lifecycle hooks; its entry source reexports schema, GraphQL, and application type definitions.
- The client submits the requested resource and action to the authorization endpoint.
- The client sends request credentials to the configured API URL; Express, Fastify, Next.js, and Nest integrations call the authorization check with the current request.
- Debug logging is gated by DEBUG_GRANT being set to 1.
Evidence against
- The client forwards a request token and cookie, but the source routes them to the configured Grant API for the requested authorization check; no unrelated recipient or automatic collection was identified.
Behavioral surface
EnvironmentVars
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "@grantjs/server",
"version": "1.18.4",
"description": "Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js",
"type": "module",
"main": "./dist/index.cjs",
"module": "./dist/index.mjs",
"
Low
Suspicious Lifecycle Evidence
package.json points to the dist entrypoints and lists no install lifecycle hooks.
package.jsonView on unpkg · L198},
"scripts": {
"build": "vite build",
"build:watch": "vite build --watch",
"type-check": "tsc --noEmit",
"lint": "eslint src --ext .ts",
"lint:fix": "eslint src --ext .ts --fix",
"test": "vitest",
"test:run": "vitest run",
"test:coverage": "vitest run --coverage"
}
}
Low
Suspicious Lifecycle Evidence
package.json points to the dist entrypoints and lists no install lifecycle hooks.
package.jsonView on unpkg · L98.lpm-dependency-evidence-5989b04f-b526-4648-befb-1a51633d91ba/0/npm-linux/package.jsonView file
Findings
5 Medium5 Low
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
MediumStripped Provenance Metadatadist/express.mjs
MediumStripped Provenance Metadatadist/fastify.mjs
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-5989b04f-b526-4648-befb-1a51633d91ba/0/npm-linux/package.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-5989b04f-b526-4648-befb-1a51633d91ba/0/npm-linux/src/index.ts
Affected versions and remediation
This report applies to @grantjs/server@1.18.4.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.18.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.