@graphysdk/react@1.9.0-beta.1793034769315
Graphy charting SDK for React
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe runtime telemetry is production-only, uses a fixed package-associated endpoint, omits browser credentials, and exposes a telemetry opt-out. The dependency's postinstall hook only prints a banner, and the inspected package and dependency sources show no concrete attack behavior.
Decision evidence
public snapshot- The package manifest has no lifecycle script; its runtime entrypoints and dependencies are declared for chart rendering.
- The chart-created telemetry runs in production browsers, can be disabled with telemetry={false}, and sends with browser credentials omitted.
- The telemetry helper derives chart structure and feature counts, not chart rows or annotation text.
- The event includes the browser hostname and goes to the package's fixed Graphy Sentry endpoint; this is package-aligned usage telemetry.
- The dependency postinstall only conditionally prints an installation message; it does not modify files or send network requests.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/editable.browser.mjsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.cjsView on unpkgFindings
Affected versions and remediation
This report applies to @graphysdk/react@1.9.0-beta.1793034769315.
See all versions of @graphysdk/react for other recorded verdicts.
- Review the evidence and your use of @graphysdk/react@1.9.0-beta.1793034769315 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.