registry / @graphysdk/react / 1.9.0-beta.1792580582727
@graphysdk/react@1.9.0-beta.1792580582727
Graphy charting SDK for React
AI Security Review
scanned 15d ago · by lpm-firewall-aiInspected the package entrypoints, the flagged browser bundle, and the selected dependency manifests and runtime files. The telemetry sender is gated on a valid DSN, but the packaged defaults are empty; the reachable dependency postinstall only prints a conditional welcome message.
Static reason
No blocking static signals were detected.
Trigger
Package installation or rendering a chart through GraphProvider.
Impact
No confirmed attack surface was established.
Mechanism
The inspected install hook writes a conditional message to stdout. Runtime telemetry requires a valid destination, but the built-in destination is empty.
AI rationale
Inspected the package entrypoints, the flagged browser bundle, and the selected dependency manifests and runtime files. The telemetry sender is gated on a valid DSN, but the packaged defaults are empty; the reachable dependency postinstall only prints a conditional welcome message.
Evidence
package.jsondist/index.mjsdist/index.cjsdist/editable.browser.mjs.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/0/npm-linux/dist/editable.cjs.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/0/npm-linux/dist/index.cjs.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/0/npm-linux/dist/index.mjs.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/0/npm-linux/package.json.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/1/npm-linux/package.json.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/1/npm-linux/dist/index.cjs.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/1/npm-linux/dist/index.mjs.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/2/npm-linux/package.json.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/2/npm-linux/scripts/postinstall.mjs
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports charting components and pins matching Graphy renderer, telemetry, and visualization engine releases; the inspected entrypoints connect those APIs without install-time code.
- The server entrypoint contains a telemetry sender, but its destination is an empty built-in value; sending also requires a valid destination, production mode, a browser, and telemetry not being disabled.
- The browser bundle has the same empty destination and only reaches its sender when that destination parses as a valid service URL.
- The visualization engine’s postinstall prints a welcome message outside CI; the script writes only to stdout.
Evidence against
Behavioral surface
EnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/editable.browser.mjsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/editable.browser.mjsView on unpkgpackage.jsonView file
25"exports": {
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.mjs",
"require": "./dist/index.cjs"
},
"./editable": {
"types": "./dist/editable.d.ts",
"import": "./dist/editable.mjs",
"require": "./dist/editable.cjs"
Low
Ai Review Evidence
The package exports charting components and pins matching Graphy renderer, telemetry, and visualization engine releases; the inspected entrypoints connect those APIs without install-time code.
package.jsonView on unpkg · L25Findings
1 High1 Medium10 Low
HighSemantic Analysis Limiteddist/editable.browser.mjs
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/0/npm-linux/dist/editable.cjs
LowAi Review Evidence.lpm-dependency-evidence-48ee2f95-ac2c-435d-8b2d-56bd87b8461f/0/npm-linux/dist/index.cjs
Affected versions and remediation
This report applies to @graphysdk/react@1.9.0-beta.1792580582727.
See all versions of @graphysdk/react for other recorded verdicts.
- Review the evidence and your use of @graphysdk/react@1.9.0-beta.1792580582727 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.