registry / @nanonets/graft / 0.12.1
@nanonets/graft@0.12.1
Build a repo's context graph as a folder of linked markdown files: a local, regenerable cache that every query keeps in sync with your code.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install-time behavior or exfiltration chain was found. The explicit global AI-agent hook/MCP installation is a meaningful lifecycle risk that warrants a warning under policy.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `graft init` and selects/detects the agents integration without `--no-global`.
Impact
Persistent package-controlled integration in Codex and other AI-agent environments, plus anonymized telemetry transmission.
Mechanism
Explicit AI-agent MCP, instruction, and lifecycle-hook registration.
AI rationale
No concrete malicious install-time behavior or exfiltration chain was found. The explicit global AI-agent hook/MCP installation is a meaningful lifecycle risk that warrants a warning under policy.
Evidence
package.jsonscripts/postinstall.mjsdist/cli.jsdist/hosts/mcp-config.jsdist/hosts/codex-hooks.jsdist/telemetry/send.js~/.codex/config.toml~/.codex/hooks.json~/.codex/hooks/graft/graft-hooks.cjsAGENTS.md.mcp.json.claude/settings.json
Network endpoints1
events.nanonets.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `graft init` wires AI-agent instruction, MCP, hook, and statusline integration.
- When Codex is detected, init targets the global `~/.codex/config.toml` MCP configuration.
- Init installs global Codex lifecycle hooks that run a Graft shim on SessionStart, prompt submission, edits, and Stop.
- Runtime telemetry posts queued analytics batches to Nanonets' PostHog endpoint.
Evidence against
- `postinstall` only prints an opt-in init nudge; it performs no configuration write.
- Agent wiring is reachable through the explicit `init` command and offers dry-run and `--no-global` safeguards.
- No install-time payload execution, credential harvesting, destructive action, or remote code loading was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/claude/shim-template.jsView file
22return `#!/usr/bin/env node
L23: const path = require('path');
L24: const fs = require('fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/claude/shim-template.jsView on unpkg · L22Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/ai/llm/claude-cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/claude/shim-template.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nanonets/graft@0.12.1.
See all versions of @nanonets/graft for other recorded verdicts.
- Review the evidence and your use of @nanonets/graft@0.12.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.