@nanonets/graft@0.19.0
Build a repo's context graph as a folder of linked markdown files: a local, regenerable cache that every query keeps in sync with your code.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source supports an explicit user-command agent configuration capability, which is warning-only under the agent integration policy. No concrete malicious installation chain or exfiltration behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs graft init and selects or explicitly specifies agent targets.
Impact
This is a user-invoked agent configuration capability, not a confirmed attack.
Mechanism
The command writes agent wiring, including MCP and Claude integration; Claude setup may write user-level configuration unless no-global is used.
AI rationale
The source supports an explicit user-command agent configuration capability, which is warning-only under the agent integration policy. No concrete malicious installation chain or exfiltration behavior was found.
Evidence
dist/cli.jsdist/claude/init.js.claude/settings.json.claude/helpers/graft-statusline.cjs.claude/helpers/graft-hooks.cjs.claude/skills/graft/SKILL.md.mcp.json
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package declares a postinstall hook, but its install message directs the user to separately run the init command to enable agent integration.
- The explicit graft init command is designed to wire AI coding agents with instruction files, MCP registration, hooks, and a status line.
- Interactive init selects targets through a picker; noninteractive use requires explicit flags or otherwise exits without writing.
- Claude initialization writes configuration and can install a user-level Claude integration unless the user passes the no-global option.
- The inspected context helper targets a repository-local gitignore entry, and the signup listener binds only to loopback.
Evidence against
- No evidence showed the install hook writing agent configuration; it only points users to the separate init command.
- No secret harvesting, unrestricted credential forwarding, remote payload execution, or destructive behavior was identified in the inspected sources.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.mjsView file
27if (!existsSync(entry) || !existsSync(cli)) return;
L28: const mod = await import(pathToFileURL(entry).href);
L29: // A `dist/` from an older version has no such export. Absent, not broken.
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/postinstall.mjsView on unpkg · L27Findings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/app/checkout.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/brain/signup.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nanonets/graft@0.19.0.
See all versions of @nanonets/graft for other recorded verdicts.
- Review the evidence and your use of @nanonets/graft@0.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.