registry / @patchstack/connect / 0.5.4

@patchstack/connect@0.5.4

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface was found. Reporting and project changes require explicit CLI or runtime configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit scan or setup command, or a configured enrolled runtime guard.

Impact

May send configured security-report data to Patchstack.

Mechanism

User-invoked dependency and detection reporting.

AI rationale

The scanner findings reflect a security-monitoring product with explicit command and configuration paths. Source inspection found no automatic registry install hook, secret harvesting, metadata access, or hidden execution.

Network endpoints1

api.patchstack.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Evidence for AI clean decision

No preinstall, install, or postinstall hook is declared by the published package.
Network reporting is reached through the exported scanAndReport function, not at module import.

@patchstack/connect@0.5.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code