registry / @posterna/next / 0.1.2
@posterna/next@0.1.2
Next.js integration for Posterna: verify AI agents and crawlers and apply policy.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source matches the package’s stated Next.js policy-integration purpose and contains no install hook or unrelated data collection. Its optional counters are documented, send only when a Posterna site key is configured, and can be disabled.
Static reason
No blocking static signals were detected.
Trigger
Policy loading occurs when the adapter is created; counters record requests during adapter use and transmit only when a site key is configured.
Impact
Applies the configured policy and, when enabled by a site key, shares aggregated request metrics with Posterna.
Mechanism
Reads the configured policy file. Counters aggregate verdict and policy buckets and send them to the Posterna service; they can be disabled with counters: false.
AI rationale
The source matches the package’s stated Next.js policy-integration purpose and contains no install hook or unrelated data collection. Its optional counters are documented, send only when a Posterna site key is configured, and can be disabled.
Evidence
agents.yaml (read by default; configurable via policyPath or POSTERNA_POLICY)
Network endpoints1
posterna.com/v1/ingest
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Next.js policy integration and declares no lifecycle scripts; its scripts are build and typecheck.
- At runtime, the adapter reads the configured policy file, defaulting to agents.yaml, to create the policy engine.
- The adapter sets up counters by default but supports disabling them with counters: false.
- The dependency documents that counters aggregate request buckets and send them to the Posterna cloud only when POSTERNA_SITE_KEY is configured; without a key, nothing is sent.
- The counter payload is POSTed to the configured base URL’s ingest path with the site key as a bearer token.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
5 flaggedpackage.jsonView file
2"name": "@posterna/next",
"version": "0.1.2",
"description": "Next.js integration for Posterna: verify AI agents and crawlers and apply policy.",
"keywords": [
"ai-agen
Low
Suspicious Lifecycle Evidence
The manifest describes a Next.js policy integration and declares no lifecycle scripts; its scripts are build and typecheck.
package.jsonView on unpkg · L2dist/index.jsView file
87const read = readPolicyFile(options.policyPath ?? env.POSTERNA_POLICY, warn);
policyLoad = read.problem ? { source: "fallback", problem: read.problem } : { source: "file", problem: nul
Low
Ai Review Evidence
At runtime, the adapter reads the configured policy file, defaulting to agents.yaml, to create the policy engine.
dist/index.jsView on unpkg · L8796, env });
}
let counters = null;
if (options.counters !== false) {
try {
counters = createCounters({
siteKey: options.siteKey,
baseUrl: options.baseUrl,
env,
onError: warn,
...options.counters ?? {},
sdk: { name: "@posterna/next", versi
Findings
1 Medium8 Low
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-49bbf947-9502-45e1-9536-d8dad1cb0f9f/0/npm-linux/README.md
LowAi Review Evidence.lpm-dependency-evidence-49bbf947-9502-45e1-9536-d8dad1cb0f9f/0/npm-linux/dist/index.js
Affected versions and remediation
This report applies to @posterna/next@0.1.2.
See all versions of @posterna/next for other recorded verdicts.
- Review the evidence and your use of @posterna/next@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.