registry / @grantjs/server / 1.25.0
@grantjs/server@1.25.0
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 12h ago · by lpm-firewall-aiThe flagged Nest bundle contains ordinary framework integration code, and the client sends request credentials only with authorization requests to the configured Grant API URL. The manifest declares no install hook or import-time collector.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Application code imports an integration and invokes its middleware, guard, or GrantClient authorization method.
Impact
The service receives the authentication and authorization data needed to evaluate the requested permission; no unrelated collection or attack behavior was identified.
Mechanism
The client sends permission details and, when provided, the incoming request's token or cookie to the configured Grant API URL.
AI rationale
The flagged Nest bundle contains ordinary framework integration code, and the client sends request credentials only with authorization requests to the configured Grant API URL. The manifest declares no install hook or import-time collector.
Network endpoints1
User-configured apiUrl; api.grant.com appears as a documented example
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a server authorization SDK and exports framework integrations; it declares no install lifecycle hooks.
- The package scripts are build, type-check, lint, and test commands.
- Authorization calls POST permission and resource context to the configured Grant API endpoint.
- The client forwards a request token and cookie as authorization inputs for that API call.
- The flagged Nest bundle contains framework decorators and imports the Grant client and debug helper.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
6 flaggeddist/nest.cjsView file
•matchType = malicious_source_fingerprint_signature
signature = 80687cbc7fc3ee80
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @grantjs/server@1.22.0
matchedPath = dist/nest.cjs
matchedIdentity = npm:QGdyYW50anMvc2VydmVy:1.22.0
similarity = 1.000
shingleOverlap = 14
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/nest.cjsView on unpkg1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
const require_grant_client = require("./grant-client-DEaSxech.cjs");
const require_debug = require("./debug-Bd3mwO_G.cjs");
let _nestjs_common = require("@nestjs/common");
// src/nest/grant.decorator.ts
/**
* Metadata key for Grant options (resource, action) on route handlers.
* Used by GrantGuard when options are not passed in the constructor.
*/
var GRANT_OPTIONS_KEY = "grant:options";
function Grant(resourceOrOptions, action) {
return (0, _nestjs_common.SetMetadata)(GR
Low
Ai Review Evidence
The flagged Nest bundle contains framework decorators and imports the Grant client and debug helper.
dist/nest.cjsView on unpkg · L1package.json
Findings
1 High4 Medium3 Low
HighKnown Malware Source Fingerprint Signaturedist/nest.cjs
MediumEnvironment Vars
MediumStripped Provenance Metadatapackage.json
MediumStripped Provenance Metadatadist/grant-client-DEaSxech.cjs
MediumStripped Provenance Metadatadist/grant-client-DEaSxech.cjs
LowScripts Present
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/nest.cjs
Affected versions and remediation
This report applies to @grantjs/server@1.25.0.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.