@nanonets/graft@0.10.0
Build a repo's context graph as a folder of linked markdown files that live in the repo and stay in sync with the code through git.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not malicious by static inspection: its postinstall is informational only and no secret theft, remote payload execution, or unconsented lifecycle mutation was found. Its explicit init command nevertheless installs global and repo-local agent hooks/configuration, so warn under the agent-capability policy.
Decision evidence
public snapshot- Explicit `graft init` can register a global Codex MCP entry and PostToolUse hook.
- The hook runs after Write/Edit/MultiEdit and invokes the package shim.
- Claude integration writes project `.claude` settings, shims, skill, and MCP registration.
- `postinstall` only checks for an existing helper and prints an opt-in init message.
- Global writes occur only through the user-invoked `init` command, with `--no-global` support.
- AI API keys are supplied by CLI/environment configuration for user-selected providers; no credential harvesting or unrelated exfiltration found.
- No install-time config mutation, remote payload loading, destructive behavior, or stealth persistence found.
Source & flagged code
4 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
dist/claude/shim-template.jsView on unpkg · L17Findings
Affected versions and remediation
This report applies to @nanonets/graft@0.10.0.
See all versions of @nanonets/graft for other recorded verdicts.
- Review the evidence and your use of @nanonets/graft@0.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.