registry / @promptowl/contextnest-community / 1.25.0

@promptowl/contextnest-community@1.25.0

⚠ Under review

ContextNest Community Edition — self-hosted context governance server for AI workflows. Commercial software by Promptowl LLC.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 87 file(s), 3.83 MB of source, external domains: accounts.google.com, adaptivecards.io, app.posthog.com, app.promptowl.ai, claude.ai, claude.com, code.claude.com, community.example.com, cursor.com, developers.openai.com, docs.x.ai, example.com, github.com, grok.com, hermes-agent.nousresearch.com, hooks.slack.com, json-schema.org, learn.chatgpt.com, login.microsoftonline.com, nest.example.com, nest.yourcompany.com, nodejs.org, player.vimeo.com, posthog.com, promptowl.ai, prosemirror.net, radix-ui.com, reactjs.org, sentry.io, stuk.github.io, us.i.posthog.com, us.posthog.com, www.npmjs.com, www.perplexity.ai, www.w3.org, www.youtube-nocookie.com, www.youtube.com, yandex.com

Source & flagged code

3 flagged

dist/web3/assets/page-BYc2DIux.jsView file

Lines 6-46javascript

6 */const Rr=[["rect",{width:"20",height:"5",x:"2",y:"3",rx:"1",key:"1wp1u1"}],["path",{d:"M4 8v11a2 2 0 0 0 2 2h2",key:"tvwodi"}],["path",{d:"M20 8v11a2 2 0 0 1-2 2h-2",key:"1gkqxj"}],["path",{d:"m9 15 3-3 3 3",key:"1pd0qc"}],["path",{d:"M12 12v9",key:"192myk"}]],Tr=dt("archive-restore",Rr);/**

7 * @license lucide-react v0.577.0 - ISC

8 *

9 * This source code is licensed under the ISC license.

10 * See the LICENSE file in the root directory of this source tree.

11 */const Fr=[["path",{d:"M17 3a2 2 0 0 1 2 2v15a1 1 0 0 1-1.496.868l-4.512-2.578a2 2 0 0 0-1.984 0l-4.512 2.578A1 1 0 0 1 5 20V5a2 2 0 0 1 2-2z",key:"oz39mx"}]],Br=dt("bookmark",Fr);/**

12 * @license lucide-react v0.577.0 - ISC

13 *

14 * This source code is licensed under the ISC license.

15 * See the LICENSE file in the root directory of this source tree.

16 */const Pr=[["path",{d:"M9 20H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H20a2 2 0 0 1 2 2v.5",key:"1dkoa9"}],["path",{d:"M12 10v4h4",key:"1czhmt"}],["path",{d:"m12 14 1.535-1.605a5 5 0 0 1 8 1.5",key:"lvuxfi"}],["path",{d:"M22 22v-4h-4",key:"1ewp4q"}],["path",{d:"m22 18-1.535 1.605a5 5 0 0 1-8-1.5"

18JSZip v3.10.1 - A JavaScript class for generating and reading zip files

19<http://stuartk.com/jszip>

22Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

24JSZip uses the library pako released under the MIT license :

25https://github.com/nodeca/pako/blob/main/LICENSE

26*/var Ct;function Hr(){return Ct||(Ct=1,(function(W,Q){(function(m){W.exports=m()})(function(){return

27\0`,V+=c(z,2),V+=B.magic,V+=c(w,2),V+=c(N,2),V+=c(ne.crc32,4),V+=c(ne.compressedSize,4),V+=c(ne.uncompressedSize,4),V+=c(M.length,2),V+=c(R.length,2),{fileRecord:v.LOCAL_FILE_HEADER+V+M+R,dirRecord:v.CENTRAL_FILE_HEADER+c(ee,2)+V+c(re.length,2)+"\0\0\0\0"+c(E,4)+c(h,4)+M+R+re}}var r=m("../utils"),a=m("../stream/GenericWorker"),_=m("../utf8"),y=m("../crc32"),v=m("../signature");function b(i,p,n,h){a.call(this,"ZipFileWorker"),this.bytesWritten=0,this.zipComment=p,this.zipPlatform=n,this.encodeFileName=h,this.streamFiles=i,this.accumulate=!1,this.contentBuffer=[],this.dirRecords=[],this.currentS ...

28`),C=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!m.startsWith("---")||!m.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-BYc2DIux.jsView on unpkg · L26

30---

32`))return[{path:Q,content:W}];const x=[];for(const r of m.split(`

34---

36`))C(r)||x.length===0?x.push(r):x[x.length-1]+=`

38---

40${r}`;if(x.length<2)return[{path:Q,content:W}];const c=(r,a)=>{var y,v;return(((v=(y=r.match

41 - a positive number

42 - less than the value passed to \`max\` (or ${ht} if no \`max\` prop is set)

43 - \`null\` or \`undefined\` if the progress is indeterminate.

45Defaulting to \`null\`.`}var Ut=Tt,sn=Bt;const Lt=ie.forwardRef(({className:W,value:Q,...m},C)=>s.jsx(Ut,{ref:

Long lines were clipped for display.

dist/web3/assets/MarkdownEditor-Dfk5uIE5.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web3/assets/MarkdownEditor-Dfk5uIE5.jsView on unpkg

dist/chunk-JDAOA5KP.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @promptowl/contextnest-community@1.22.0 matchedIdentity = npm:[redacted]:1.22.0 similarity = 0.520 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-JDAOA5KP.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/web3/assets/page-BYc2DIux.jsView file

26*/var Ct;function Hr(){return Ct||(Ct=1,(function(W,Q){(function(m){W.exports=m()})(function(){return(function m(C,x,c){function o(_,y){if(!x[_]){if(!C[_]){var v=typeof $e=="functi... L27: \0`,V+=c(z,2),V+=B.magic,V+=c(w,2),V+=c(N,2),V+=c(ne.crc32,4),V+=c(ne.compressedSize,4),V+=c(ne.uncompressedSize,4),V+=c(M.length,2),V+=c(R.length,2),{fileRecord:v.LOCAL_FILE_HEADE... L28: `),C=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!m.startsWith("---")||!m.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-BYc2DIux.jsView on unpkg · L26

dist/web3/assets/MarkdownEditor-Dfk5uIE5.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web3/assets/MarkdownEditor-Dfk5uIE5.jsView on unpkg

Findings

2 High3 Medium7 Low

HighSemantic Analysis Limiteddist/web3/assets/MarkdownEditor-Dfk5uIE5.js

HighPrevious Version Dangerous Deltadist/chunk-JDAOA5KP.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/web3/assets/page-BYc2DIux.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @promptowl/contextnest-community@1.25.0.

See all versions of @promptowl/contextnest-community for other recorded verdicts.

Review the evidence and your use of @promptowl/contextnest-community@1.25.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 03:33:52.042Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.