registry / @grantjs/server / 1.18.9
@grantjs/server@1.18.9
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest and entry points match a server authorization SDK, with no install hook or import-time action identified. Network traffic is tied to an explicit authorization call and the configured API URL; the environment variable only enables development logging.
Static reason
No blocking static signals were detected.
Trigger
An application invokes an authorization method or configured middleware/guard handles a request.
Impact
Expected authorization traffic and optional development logging; no automatic collection or unrelated destination was identified.
Mechanism
The client posts permission and resource context to the configured apiUrl and attaches request credentials for that authorization check. DEBUG_GRANT enables local console logging.
AI rationale
The manifest and entry points match a server authorization SDK, with no install hook or import-time action identified. Network traffic is tied to an explicit authorization call and the configured API URL; the environment variable only enables development logging.
Network endpoints1
Configured apiUrl + /api/auth/is-authorized
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as a server authorization SDK and points its exports to the dist entry points.
- The package scripts are build, type-check, lint, and test commands; no install lifecycle scripts are declared.
- The main entry point only imports and exports the Grant client, token helpers, and errors.
- Authorization requests POST permission and resource context to the Grant API path using the configured apiUrl; request credentials are attached for that request.
- DEBUG_GRANT only enables console logging of authorization resource, action, outcome, and denial reason.
Evidence against
- The client can transmit request-derived bearer tokens and cookies when authorization middleware invokes it, as expected for an authorization SDK.
- The environment variable DEBUG_GRANT controls development logging. It does not enable network transmission.
Behavioral surface
EnvironmentVars
Source & flagged code
6 flaggedpackage.jsonView file
2"name": "@grantjs/server",
"version": "1.18.9",
"description": "Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js",
"type": "module",
"main
Medium
Stripped Provenance Metadata
The manifest identifies this as a server authorization SDK and points its exports to the dist entry points.
package.jsonView on unpkg · L2100"scripts": {
"build": "vite build",
"build:watch": "vite build --watch",
"type-check": "tsc --noEmit",
"lint": "eslint src --ext .ts",
"lint:fix": "eslint src --ext .ts --fix",
Low
Suspicious Lifecycle Evidence
The package scripts are build, type-check, lint, and test commands; no install lifecycle scripts are declared.
package.jsonView on unpkg · L100dist/index.mjsView file
1import { i as extractTokenFromRequest, r as extractBearerToken, t as GrantClient } from "./grant-client-1Cd2jhvZ.js";
import { a as NotFoundError, i as GrantServerError, n as AuthorizationError, r as BadRequestError, t as AuthenticationError } from "./errors-CfqUl3ZG.js";
export { AuthenticationError, AuthorizationError, BadRequestError, GrantClient, GrantServerError, NotFoundError, extractBearerToken, extractTokenFromRequest };
Findings
5 Medium3 Low
MediumEnvironment Vars
MediumStripped Provenance Metadatapackage.json
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
MediumStripped Provenance Metadatadist/debug-DfEEZ0z2.js
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @grantjs/server@1.18.9.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.18.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.