registry / @grantjs/server / 1.18.7
@grantjs/server@1.18.7
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found no lifecycle hook or concrete attack behavior. The credential forwarding is part of an authorization request to the API URL configured by the consuming application.
Static reason
No blocking static signals were detected.
Trigger
An application invokes an authorization check through the client or framework middleware.
Impact
This supports the package's stated authorization purpose; no unrelated data collection or fixed external recipient was found.
Mechanism
The client posts the requested permission and resource context to the configured API URL, forwarding the request token or cookie for that authorization call.
AI rationale
Source inspection found no lifecycle hook or concrete attack behavior. The credential forwarding is part of an authorization request to the API URL configured by the consuming application.
Evidence
dist/grant-client-1Cd2jhvZ.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest declares standard build, lint, and test scripts and no install lifecycle hooks.
- The declared runtime dependency exports schema and type modules; its manifest has no install hook.
- The published entrypoint exports the Grant authorization client.
- Authorization checks send the requested permission and resource context to the authorization endpoint.
- The client uses the configured API URL and forwards a request token or cookie for authorization; no fixed external recipient is present.
- Debug output is disabled unless the debug environment flag is enabled.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
8 flaggedpackage.jsonView file
100"scripts": {
"build": "vite build",
"build:watch": "vite build --watch",
"type-check": "tsc --noEmit",
"lint": "eslint src --ext .ts",
"lint:fix": "eslint src -
Low
Suspicious Lifecycle Evidence
The package manifest declares standard build, lint, and test scripts and no install lifecycle hooks.
package.jsonView on unpkg · L10074"dependencies": {
"@grantjs/schema": "1.18.7"
},
"devDependencies": {
"@types/express": "^5.0.0",
"@types/node": "^26.6.5",
"@vitest/coverage-v8": "^5.0.5",
Low
Suspicious Lifecycle Evidence
The package manifest declares standard build, lint, and test scripts and no install lifecycle hooks.
package.jsonView on unpkg · L74.lpm-dependency-evidence-2561d3c6-b360-4062-bbc2-4bb4cacc0d3f/0/npm-linux/package.jsonView file
Findings
5 Medium5 Low
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/index.mjs
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-2561d3c6-b360-4062-bbc2-4bb4cacc0d3f/0/npm-linux/package.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-2561d3c6-b360-4062-bbc2-4bb4cacc0d3f/0/npm-linux/src/index.ts
Affected versions and remediation
This report applies to @grantjs/server@1.18.7.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.18.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.