registry / @patchstack/connect / 0.5.3

@patchstack/connect@0.5.3

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package reports configured security data to its vendor and can modify project scripts only through an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs the CLI setup or scan command, or enables configured runtime protection.

Impact

It may send dependency and site metadata to Patchstack and add scan commands to a user project after explicit setup.

Mechanism

Configured vendor manifest reporting and explicit project build-hook wiring.

AI rationale

The scanner's network and metadata findings correspond to the package's security-monitoring and SSRF-blocking functions. Although setup can add lifecycle commands to a consumer project, this occurs only after an explicit CLI command and the package itself has no registry install hook.

Evidence

package.json

Network endpoints1

api.patchstack.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Evidence for AI clean decision

The runtime entrypoints can post a dependency manifest, site URL, and site name to Patchstack.
The explicit `setup` command rewrites the consumer project's lifecycle scripts to run scans.
The metadata-host finding is a defensive SSRF rule that blocks internal destinations.
The manifest has no preinstall, install, or postinstall hook; its only lifecycle hook is prepare.

Evidence against

No import-time execution was found in the library entrypoints.
Reporting is tied to configured runtime protection or explicit CLI commands.
No self-dependency, shell execution, credential harvesting beyond Patchstack configuration, or foreign AI-agent configuration writes were found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 1.38 MB of source, external domains: api.patchstack.com, app.patchstack.com, cdn.patchstack.com, patchstack.com, patchstack.local

Source & flagged code

5 flagged

dist/protect.edge.jsView file

Lines 1-26javascript

1var __create = Object.create;

2var __defProp = Object.defineProperty;

3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __getProtoOf = Object.getPrototypeOf;

6var __hasOwnProp = Object.prototype.hasOwnProperty;

7var __commonJS = (cb, mod) => function __require() {

8 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

9 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

10 } catch (e) {

11 throw mod = 0, e;

12 }

13};

14var __copyProps = (to, from, except, desc) => {

15 if (from && typeof from === "object" || typeof from === "function") {

16 for (let key of __getOwnPropNames(from))

17 if (!__hasOwnProp.call(to, key) && key !== except)

18 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

19 }

20 return to;

21};

22var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

23 // If the importer is in node compatibility mode or this is not an ESM

24 // file that has been converted to a CommonJS file using a Babel-

25 // compatible transform (i.e. "__esModule" has not been set), then set

26 // "default" to the CommonJS "module.exports" for node compatibility.

Lines 255-295javascript

255 const u = new URL(value);

256 if (u.protocol === "https:") return true;

257 return u.protocol === "http:" &&

dist/index.jsView file

Lines 2-42javascript

2import { access } from "fs/promises";

3import path5 from "path";

5// src/types.ts

6var PatchstackError = class extends Error {

dist/index.cjsView file

Lines 61-101javascript

61var import_promises7 = require("fs/promises");

62var import_node_path5 = __toESM(require("path"), 1);

64// src/types.ts

65var PatchstackError

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.5.6 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.5.6 similarity = 0.741 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/protect.edge.jsView file

275// src/protect/engine/client.js L276: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L277: var DEFAULT_CACHE_TTL = 3e5; ... L289: this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4; L290: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L291: this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint"); ... L314: headers, L315: body: JSON.stringify({}), L316: signal: AbortSignal.timeout(this.#timeoutMs) ... L330: } L331: const data = await response.json(); L332: if (!data || !Array.isArray(data.firewall)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.edge.jsView on unpkg · L275

6var __hasOwnProp = Object.prototype.hasOwnProperty; L7: var __commonJS = (cb, mod) => function __require() { L8: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

dist/index.jsView file

22try { L23: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L24: } catch { ... L28: try { L29: parsed = JSON.parse(raw); L30: } catch { ... L1226: }, L1227: body: JSON.stringify({ L1228: grant_type: "client_credentials", ... L1252: } L1253: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1254: const send = async () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L22

dist/index.cjsView file

81Trigger-reachable chain: manifest.main -> dist/index.cjs L81: try { L82: raw = await (0, import_promises.readFile)(import_node_path.default.join(cwd, "package.json"), "utf8"); L83: } catch { ... L87: try { L88: parsed = JSON.parse(raw); L89: } catch { ... L1285: }, L1286: body: JSON.stringify({ L1287: grant_type: "client_credentials", ... L1311: } L1312: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1313: const send = async () => {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L81

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

3 Critical1 High4 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

CriticalPrevious Version Dangerous Deltadist/cli.js

HighCloud Metadata Accessdist/protect.edge.js

MediumDynamic Requiredist/protect.edge.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @patchstack/connect@0.5.3.

See version security history for other recorded verdicts.

Review the evidence and your use of @patchstack/connect@0.5.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 10:07:09.408Z (UTC).

90%Clean

AI assessment confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Package metadata

npm

Maintainerspatchstack_elliot

Version0.5.3

Latest on npm0.5.34

PublishedSep 10, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size595 KB

Files41

Keywordspatchstacksecurityapplication-securitynodejs-securityruntime-securityraspvirtual-patchingwaf

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.cjsmodule → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → patchstack-connect

Runtimenode >=20

Artifact2.36 MB · 41 files1 signature(s) · provenance

Install lifecycleprepareprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean