registry / @grantjs/server / 1.23.1
@grantjs/server@1.23.1
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe inspected entry points and flagged Nest bundle implement a server authorization SDK: they extract request credentials and send permission checks to the configured Grant API. No install hooks, unrelated data collection, or concealed attack behavior was identified.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Applications call the exported client or configure middleware and guards; authorization checks run when those integrations handle a request.
Impact
The inspected behavior supports the package's stated server authorization purpose; no unrelated data collection or account actions were found.
Mechanism
The client sends a permission check and the request's Grant token to the caller-configured API URL. DEBUG_GRANT only enables local debug logging.
AI rationale
The inspected entry points and flagged Nest bundle implement a server authorization SDK: they extract request credentials and send permission checks to the configured Grant API. No install hooks, unrelated data collection, or concealed attack behavior was identified.
Network endpoints1
Configured apiUrl (documentation examples use https://api.grant.com), path /api/auth/is-authorized
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The npm scripts are build, lint, type-check, and test commands; there are no lifecycle hooks.
- The Nest module creates its client only when the application calls forRoot(config).
- The Nest guard checks the request token and configured permission before requesting authorization.
- The client posts the permission check to /api/auth/is-authorized and sends the request token to the configured apiUrl.
- The only environment variable read is DEBUG_GRANT, which enables debug logging.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
7 flaggeddist/nest.cjsView file
•matchType = malicious_source_fingerprint_signature
signature = 80687cbc7fc3ee80
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @grantjs/server@1.22.0
matchedPath = dist/nest.cjs
matchedIdentity = npm:QGdyYW50anMvc2VydmVy:1.22.0
similarity = 1.000
shingleOverlap = 14
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/nest.cjsView on unpkg112if (!this.client) throw new _nestjs_common.ForbiddenException("GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.");
if (!await require_grant_client.extractTokenFromRequest(request, this.client.config)) throw new _nestjs_common.UnauthorizedException({
err
Medium
Stripped Provenance Metadata
The Nest guard checks the request token and configured permission before requesting authorization.
dist/nest.cjsView on unpkg · L11224// src/nest/grant.module.ts
var _GrantModule;
var GRANT_CLIENT = "GrantClient";
var GrantModule = _GrantModule = class GrantModule {
static forRoot(config) {
const client = new require_grant_client.GrantClient(config);
return {
module: _GrantModule,
providers: [{
provide: require_gran
Findings
1 High4 Medium4 Low
HighKnown Malware Source Fingerprint Signaturedist/nest.cjs
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/nest.cjs
MediumStripped Provenance Metadatadist/grant-client-DEaSxech.cjs
MediumStripped Provenance Metadatadist/grant-client-DEaSxech.cjs
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/nest.cjs
LowAi Review Evidencedist/debug-Bd3mwO_G.cjs
Affected versions and remediation
This report applies to @grantjs/server@1.23.1.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.23.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.