registry / @nanonets/graft / 0.9.1
@nanonets/graft@0.9.1
Build a repo's context graph as a folder of linked markdown files that live in the repo and stay in sync with the code through git.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete malicious chain was found by source inspection. The package warrants a warning for its explicit, guarded AI-agent extension and global hook setup capability.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `graft init` and selects/detects an agent (or passes `--yes`/agent flags).
Impact
A user-approved hook can execute Graft after editor writes and MCP configuration can expose its local server.
Mechanism
AI-agent config and hook registration for Graft graph synchronization.
AI rationale
No concrete malicious chain was found by source inspection. The package warrants a warning for its explicit, guarded AI-agent extension and global hook setup capability.
Evidence
package.jsonscripts/postinstall.mjsdist/cli.jsdist/hosts/init.jsdist/hosts/mcp-config.jsdist/hosts/codex-hooks.jsdist/claude/init.jsdist/claude/shim-template.jsdist/ai/providers.js~/.codex/config.toml~/.codex/hooks.json.claude/settings.json.mcp.json
Network endpoints1
openrouter.ai/api/v1
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `graft init` can register MCP entries and a PostToolUse hook for detected AI agents.
- Codex hook writes `~/.codex/hooks.json` to run Graft after Write/Edit/MultiEdit.
- Generated shim dynamically imports Graft code and may query `npm root -g`.
Evidence against
- `postinstall` only prints a non-CI setup message; it performs no writes or network access.
- AI-agent configuration mutation is reached only by the explicit `graft init` command and has interactive/non-TTY safeguards.
- LLM transport uses the user-supplied API key/base URL for requested deep builds; no hidden endpoint found.
- No credential harvesting, exfiltration, destructive action, eval, or remote payload execution found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/claude/shim-template.jsView file
17return `#!/usr/bin/env node
L18: const path = require('path');
L19: const fs = require('fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/claude/shim-template.jsView on unpkg · L17Findings
1 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/claude/shim-template.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nanonets/graft@0.9.1.
See all versions of @nanonets/graft for other recorded verdicts.
- Review the evidence and your use of @nanonets/graft@0.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.