registry / Credential exfiltration / @promptowl/contextnest-community
@promptowl/contextnest-community
ContextNest Community Edition — self-hosted context governance server for AI workflows. Commercial software by Promptowl LLC.
This report shows the evidence for @promptowl/contextnest-community@2.0.0. 1 of 24 known versions is blocked or flagged. The newest version, 2.2.1, is flagged. See all versions.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe startup migration sends an existing Anthropic credential to a publisher-selected hosted endpoint without checking for recipient-specific consent. This is concrete credential disclosure and supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Server startup when a BYOK entitlement is active, ANTHROPIC_API_KEY is set, and ANTHROPIC_BASE_URL is unset.
Impact
The Anthropic key is disclosed to the hosted endpoint; after a successful transfer, the local environment key is removed.
Mechanism
The migration passes the environment key to a POST request for the license own-models endpoint without a request-specific consent check.
Attack narrative
At startup, the package reads ANTHROPIC_API_KEY and automatically sends it to the default PromptOwl endpoint when BYOK is enabled and no Anthropic base URL is configured. The code then removes the local key after a successful transfer. The inspected path has no request-specific consent check for sending this existing Anthropic credential to the hosted gateway.
AI rationale
The startup migration sends an existing Anthropic credential to a publisher-selected hosted endpoint without checking for recipient-specific consent. This is concrete credential disclosure and supports blocking publication.
Evidence
dist/index.jsdist/chunk-Z7MVGD56.jsdist/chunk-RQ2E3SYL.jsdist/chunk-3N3COKIQ.js
Network endpoints1
app.promptowl.ai/api/license/own-models
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- At startup, the server calls a migration that reads ANTHROPIC_API_KEY and, when BYOK is enabled and ANTHROPIC_BASE_URL is unset, sends the key to the own-provider handler.
- That handler POSTs the key as api_key to the license own-models endpoint; the default API host is app.promptowl.ai.
- The migration runs automatically after license validation and does not check for request-specific user consent before sending the key.
Evidence against
- The transfer is conditional on a BYOK entitlement, an existing Anthropic key, and no configured Anthropic base URL; the code presents it as moving the key to the model gateway.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcedist/web3/assets/page-CfVp0e5A.jsView file
26*/var Ft;function nn(){return Ft||(Ft=1,(function(M,Y){(function(m){M.exports=m()})(function(){return(function m(C,v,c){function a(_,y){if(!v[_]){if(!C[_]){var g=typeof Ge=="functi...
L27: \0`,K+=c(I,2),K+=P.magic,K+=c(w,2),K+=c(S,2),K+=c(se.crc32,4),K+=c(se.compressedSize,4),K+=c(se.uncompressedSize,4),K+=c(W.length,2),K+=c(R.length,2),{fileRecord:g.LOCAL_FILE_HEADE...
L28: `),C=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!m.startsWith("---")||!m.includes(`
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/web3/assets/page-CfVp0e5A.jsView on unpkg · L26dist/chunk-RQ2E3SYL.jsView file
107Source sends the broad process environment to a literal external destination.
L107: var SERVICE_VERSION = (() => {
L108: for (const up of [["..", "package.json"], ["..", "..", "package.json"]]) {
L109: try {
L110: const pkg = JSON.parse(readFileSync(join(HERE, ...up), "utf8"));
L111: if (pkg?.name === "@promptowl/contextnest-community") {
...
L180: async function masterKey() {
L181: const fromEnv = (process.env.SECRETS_KEY || "").trim();
L182: if (fromEnv) {
...
L271: var DEFAULT_LICENSE_CONTACT = {
L272: url: "https://calendar.app.google/u2z8xh5PqDjQJih78",
L273: email: "support@promptowl.ai"
...
L336: headers: config.PROMPTOWL_FETCH_HEADERS,
Findings
1 Critical2 High3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-RQ2E3SYL.js
HighSemantic Analysis Limiteddist/web3/assets/MarkdownEditor-B_i-QP_G.js
HighPrevious Version Dangerous Deltadist/chunk-3N3COKIQ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/web3/assets/page-CfVp0e5A.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @promptowl/contextnest-community@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @promptowl/contextnest-community@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.