@nanonets/graft@0.18.0
Build a repo's context graph as a folder of linked markdown files: a local, regenerable cache that every query keeps in sync with your code.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has automatic, persistent, opt-out telemetry and a background network sender, which is a real privacy risk. Its network payload is statically limited and agent integration is user-invoked, so the source does not establish malicious theft or unconsented agent-control mutation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall; later telemetry flushes; explicit graft init
Impact
The vendor receives install and limited usage metadata linked to a random local identifier.
Mechanism
Persistent telemetry queue with background HTTP posting
AI rationale
The package has automatic, persistent, opt-out telemetry and a background network sender, which is a real privacy risk. Its network payload is statically limited and agent integration is user-invoked, so the source does not establish malicious theft or unconsented agent-control mutation.
Evidence
package.jsonscripts/postinstall.mjsdist/telemetry/identity.jsdist/telemetry/track.jsdist/telemetry/send.jsdist/telemetry/key.js~/.graft/telemetry.json~/.graft/telemetry-queue.ndjsondist/cli.js
Network endpoints1
events.nanonets.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The postinstall hook automatically records an install event and starts a detached telemetry process.
- Telemetry creates a persistent random install identifier in the user's home directory.
- Queued telemetry is posted to the vendor endpoint.
- The published artifact contains an active telemetry key and defaults telemetry on unless an opt-out gate is set.
- The explicit init command can register agent configuration and hooks.
Evidence against
- Telemetry properties are constrained to a fixed allowlist and do not include source files, environment values, or credentials.
- The code honors DO_NOT_TRACK and CI, and provides a disable mechanism.
- Agent configuration writes are reached through the user-invoked init command, with dry-run and no-global options.
- No self-dependency, payload download, shell execution, credential harvesting, or destructive behavior was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.mjsView file
27if (!existsSync(entry) || !existsSync(cli)) return;
L28: const mod = await import(pathToFileURL(entry).href);
L29: // A `dist/` from an older version has no such export. Absent, not broken.
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/postinstall.mjsView on unpkg · L27Findings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/app/checkout.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nanonets/graft@0.18.0.
See all versions of @nanonets/graft for other recorded verdicts.
- Review the evidence and your use of @nanonets/graft@0.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.