registry / @patchstack/connect / 0.3.33

@patchstack/connect@0.3.33

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

No unconsented install-time or import-time attack surface was found. Explicit scan and configured runtime protection can communicate with Patchstack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the scan CLI or enabling the runtime protection API with Patchstack configuration.

Impact

Configured use can send dependency inventory or bounded security-event metadata and write Patchstack configuration files.

Mechanism

User-invoked dependency reporting and security-event telemetry.

AI rationale

The scanner findings correspond to the package's explicit inventory and runtime-security functions. There is no registry-install lifecycle execution or concrete stealth, persistence, credential theft, or arbitrary code-execution chain.

Evidence

.patchstackrc.json.patchstackrc.local.json.gitignoreindex.htmlpublic/index.htmlsrc/app.html

Network endpoints1

api.patchstack.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Why the final policy warns

@patchstack/connect@0.3.33

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code