registry / @nanonets/graft / 0.21.1
@nanonets/graft@0.21.1
Build a repo's context graph as a folder of linked markdown files: a local, regenerable cache that every query keeps in sync with your code.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a guarded, explicit-command agent integration that can affect every Claude Code project, which warrants a capability warning under the agent integration policy. Static inspection found no concrete malware behavior or unconsented install-time agent-control mutation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs graft init and does not disable global configuration.
Impact
Later Claude Code sessions may load the package's configured hook and MCP integration across projects. No unconsented install-time agent configuration was found.
Mechanism
The command writes a package-owned hook shim and merges hook and MCP entries into Claude user configuration; installation separately sends gated telemetry.
AI rationale
The package contains a guarded, explicit-command agent integration that can affect every Claude Code project, which warrants a capability warning under the agent integration policy. Static inspection found no concrete malware behavior or unconsented install-time agent-control mutation.
Evidence
dist/claude/init.jsdist/hosts/claude-global.jsdist/cli.js~/.claude/helpers/graft-hooks.cjs~/.claude/settings.json~/.claude.json.mcp.json
Network endpoints1
events.nanonets.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package has a postinstall hook that loads telemetry code.
- The postinstall records an install event and starts a detached telemetry flush.
- The explicit init command registers a project MCP server and can install global Claude hooks and MCP registration.
- Global targets apply to every Claude Code project, including user settings and a user MCP configuration.
- Telemetry sends queued events by POST to the configured ingestion host.
- Context-file writes reject absolute paths and parent-directory traversal.
Evidence against
- No evidence of credential harvesting, arbitrary remote payload execution, or destructive actions was found.
- Agent configuration is initiated through the graft init command rather than the install hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.mjsView file
27if (!existsSync(entry) || !existsSync(cli)) return;
L28: const mod = await import(pathToFileURL(entry).href);
L29: // A `dist/` from an older version has no such export. Absent, not broken.
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/postinstall.mjsView on unpkg · L27Findings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/app/checkout.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/brain/signup.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nanonets/graft@0.21.1.
See all versions of @nanonets/graft for other recorded verdicts.
- Review the evidence and your use of @nanonets/graft@0.21.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.