registry / @grantjs/server / 1.20.2
@grantjs/server@1.20.2
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected entry points and client behavior match the package’s stated purpose as a server-side authorization SDK. Environment access is limited to the opt-in DEBUG_GRANT logging switch, and the manifest shows no install lifecycle hook.
Static reason
No blocking static signals were detected.
Trigger
No automatic install or import action was identified; requests occur when the caller checks authorization.
Impact
No malicious impact identified; the request supports the package's authorization function.
Mechanism
The client sends permission-check requests to the apiUrl supplied in its configuration.
AI rationale
The inspected entry points and client behavior match the package’s stated purpose as a server-side authorization SDK. Environment access is limited to the opt-in DEBUG_GRANT logging switch, and the manifest shows no install lifecycle hook.
Network endpoints1
/api/auth/is-authorized (appended to configured apiUrl)
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes an authorization middleware SDK and exposes its library entry points.
- The package has build, lint, and test scripts, with no install lifecycle script shown.
- The main entry point only imports and exports the client, token helpers, and error classes.
- Network requests are made for an explicit authorization check to the configured apiUrl, with permission data in the request body.
- The DEBUG_GRANT environment variable only enables optional debug logging.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
6 flaggedpackage.jsonView file
1{
"name": "@grantjs/server",
"version": "1.20.2",
"description": "Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js",
"ty
Medium
Stripped Provenance Metadata
The manifest describes an authorization middleware SDK and exposes its library entry points.
package.jsonView on unpkg · L1100"scripts": {
"build": "vite build",
"build:watch": "vite build --watch",
"type-check": "tsc --noEmit",
"lint": "eslint src --ext .ts",
"lint:fix": "eslint src --ext .ts --fix",
"test": "vitest",
"test:run": "vitest run",
"test:coverage": "vitest run --coverage"
}
Low
Suspicious Lifecycle Evidence
The package has build, lint, and test scripts, with no install lifecycle script shown.
package.jsonView on unpkg · L100dist/index.mjsView file
1import { i as extractTokenFromRequest, r as extractBearerToken, t as GrantClient } from "./grant-client-1Cd2jhvZ.js";
import { a as NotFoundError, i as GrantServerError, n as AuthorizationError, r as BadRequestError, t as AuthenticationError } from "./errors-CfqUl3ZG.js";
export { AuthenticationError, AuthorizationError, BadRequestError, GrantClient, GrantServerError, NotFoundError, extractBearerToken, extractTokenFromRequest };
Findings
4 Medium4 Low
MediumEnvironment Vars
MediumStripped Provenance Metadatapackage.json
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
MediumStripped Provenance Metadatadist/grant-client-1Cd2jhvZ.js
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/debug-DfEEZ0z2.js
Affected versions and remediation
This report applies to @grantjs/server@1.20.2.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.20.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.