@nanonets/graft@0.22.0
Build a repo's context graph as a folder of linked markdown files: a local, regenerable cache that every query keeps in sync with your code.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe install-time behavior is package-aligned telemetry sent to the publisher’s endpoint, limited to a random install identifier and basic metadata with CI, DO_NOT_TRACK, and saved-disable gates. Agent configuration changes are tied to the explicit graft init command, and the remaining scanner hints resolve to ordinary package functionality.
Decision evidence
public snapshot- The manifest runs scripts/postinstall.mjs; that hook records the install event and starts the telemetry flush when the built files are present.
- The install event is once per version and carries a random install ID, package/runtime metadata, and a global-install flag; the event contract does not include project data.
- The event is sent to the package publisher’s Nanonets endpoint. Telemetry runs only when its key is present and CI, DO_NOT_TRACK, and the saved disable setting do not close the gates.
- Agent setup writes are part of graft init. The inspected target locations concern repo-local files or identify setup destinations; the postinstall hook does not call that setup.
- The PR checkout uses git with hooks disabled and bounds the child process; this is review functionality, not package installation behavior.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
dist/graph/native.jsView on unpkg · L19Findings
Affected versions and remediation
This report applies to @nanonets/graft@0.22.0.
See all versions of @nanonets/graft for other recorded verdicts.
- Review the evidence and your use of @nanonets/graft@0.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.