registry / @levo-so/next-middleware / 0.3.33

@levo-so/next-middleware@0.3.33

Next middleware to add a proxy for levo integration in apps

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The entry point performs request-driven routing for documented Levo API and SEO paths, while the other inspected exports parse caller-supplied data. The manifest contains no install lifecycle hook, and no unrelated collection or autonomous behavior was found.

Static reason

No blocking static signals were detected.

Trigger

The middleware acts when the consumer invokes it for a matching request path.

Impact

No malicious behavior was identified in the inspected package source.

Mechanism

It rewrites designated requests to configured or default Levo API hosts; helper exports parse supplied header and route data.

AI rationale

Network endpoints2

public-api.levo.soinsights-api.levo.so

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines build, type-check, clean, and development scripts, with no install lifecycle hook.
The middleware defaults to Levo’s public API and insights API hosts and rewrites requests only for designated proxy paths.
SEO file proxying is limited to robots.txt, llms.txt, and sitemap XML paths, with an exclusion option.
Geo and language helpers process caller-provided headers and return parsed values; no network or file operations were found.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chain

UrlStrings

Manifest

NoLicense

scanned 3 file(s), 12.1 KB of source, external domains: insights-api.levo.so, public-api.levo.so

Source & flagged code

5 flagged

package.jsonView file

32"scripts": { "build": "tsc", "check-types": "tsc --noEmit", "clean": "npx rimraf dist node_modules .turbo", "dev": "tsc --watch" }

Low

Suspicious Lifecycle Evidence

The manifest defines build, type-check, clean, and development scripts, with no install lifecycle hook.

package.jsonView on unpkg · L32

dist/index.jsView file

11function middleware(request, options = {}) { const { apiUrl = "https://public-api.levo.so", insightsUrl = "https://insights-api.levo.so", fileExclusions = [], } = options; const { nextUrl } = request; const {

Low

Ai Review Evidence

The middleware defaults to Levo’s public API and insights API hosts and rewrites requests only for designated proxy paths.

dist/index.jsView on unpkg · L11

32if (host && pathname.startsWith("/.levo/public/api")) { const targetPath = pathname.replace(/^\/.levo\/public\/api/, ""); const workspaceQuery = workspace && !search.includes("workspace=") ? `${search ? "&" :

Findings

1 Medium8 Low

MediumEnvironment Vars

LowScripts Present

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/geoIp.js

Affected versions and remediation

This report applies to @levo-so/next-middleware@0.3.33.

See all versions of @levo-so/next-middleware for other recorded verdicts.

Review the evidence and your use of @levo-so/next-middleware@0.3.33 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 21:14:53.086Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @levo-so/next-middleware / 0.3.33

@levo-so/next-middleware@0.3.33

Next middleware to add a proxy for levo integration in apps

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

The middleware acts when the consumer invokes it for a matching request path.

Impact

No malicious behavior was identified in the inspected package source.

Mechanism

It rewrites designated requests to configured or default Levo API hosts; helper exports parse supplied header and route data.

AI rationale

Network endpoints2

public-api.levo.soinsights-api.levo.so

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines build, type-check, clean, and development scripts, with no install lifecycle hook.
The middleware defaults to Levo’s public API and insights API hosts and rewrites requests only for designated proxy paths.
SEO file proxying is limited to robots.txt, llms.txt, and sitemap XML paths, with an exclusion option.
Geo and language helpers process caller-provided headers and return parsed values; no network or file operations were found.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chain

UrlStrings

Manifest

NoLicense

scanned 3 file(s), 12.1 KB of source, external domains: insights-api.levo.so, public-api.levo.so

Source & flagged code

5 flagged

package.jsonView file

32"scripts": { "build": "tsc", "check-types": "tsc --noEmit", "clean": "npx rimraf dist node_modules .turbo", "dev": "tsc --watch" }

Low

Suspicious Lifecycle Evidence

The manifest defines build, type-check, clean, and development scripts, with no install lifecycle hook.

package.jsonView on unpkg · L32

dist/index.jsView file

Low

Ai Review Evidence

The middleware defaults to Levo’s public API and insights API hosts and rewrites requests only for designated proxy paths.

dist/index.jsView on unpkg · L11

Findings

1 Medium8 Low

MediumEnvironment Vars

LowScripts Present

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/geoIp.js

Affected versions and remediation

This report applies to @levo-so/next-middleware@0.3.33.

See all versions of @levo-so/next-middleware for other recorded verdicts.

Review the evidence and your use of @levo-so/next-middleware@0.3.33 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 21:14:53.086Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.