registry / @promptowl/contextnest-community / 1.26.0

@promptowl/contextnest-community@1.26.0

⚠ Under review

ContextNest Community Edition — self-hosted context governance server for AI workflows. Commercial software by Promptowl LLC.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 81 file(s), 3.91 MB of source, external domains: accounts.google.com, acme.example.com, adaptivecards.io, app.posthog.com, app.promptowl.ai, claude.ai, claude.com, code.claude.com, community.example.com, cursor.com, developers.openai.com, docs.x.ai, example.com, github.com, grok.com, hermes-agent.nousresearch.com, hooks.slack.com, json-schema.org, learn.chatgpt.com, login.microsoftonline.com, nest.acme.com, nest.example.com, nest.yourcompany.com, nodejs.org, player.vimeo.com, posthog.com, promptowl.ai, prosemirror.net, radix-ui.com, reactjs.org, sentry.io, stuk.github.io, us.i.posthog.com, us.posthog.com, www.npmjs.com, www.perplexity.ai, www.w3.org, www.youtube-nocookie.com, www.youtube.com, yandex.com

Source & flagged code

2 flagged

dist/web3/assets/page-YxjrE5b5.jsView file

Lines 6-46javascript

6 */const Lr=[["rect",{width:"20",height:"5",x:"2",y:"3",rx:"1",key:"1wp1u1"}],["path",{d:"M4 8v11a2 2 0 0 0 2 2h2",key:"tvwodi"}],["path",{d:"M20 8v11a2 2 0 0 1-2 2h-2",key:"1gkqxj"}],["path",{d:"m9 15 3-3 3 3",key:"1pd0qc"}],["path",{d:"M12 12v9",key:"192myk"}]],Mr=pt("archive-restore",Lr);/**

7 * @license lucide-react v0.577.0 - ISC

8 *

9 * This source code is licensed under the ISC license.

10 * See the LICENSE file in the root directory of this source tree.

11 */const Zr=[["path",{d:"M17 3a2 2 0 0 1 2 2v15a1 1 0 0 1-1.496.868l-4.512-2.578a2 2 0 0 0-1.984 0l-4.512 2.578A1 1 0 0 1 5 20V5a2 2 0 0 1 2-2z",key:"oz39mx"}]],Wr=pt("bookmark",Zr);/**

12 * @license lucide-react v0.577.0 - ISC

13 *

14 * This source code is licensed under the ISC license.

15 * See the LICENSE file in the root directory of this source tree.

16 */const $r=[["path",{d:"M9 20H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H20a2 2 0 0 1 2 2v.5",key:"1dkoa9"}],["path",{d:"M12 10v4h4",key:"1czhmt"}],["path",{d:"m12 14 1.535-1.605a5 5 0 0 1 8 1.5",key:"lvuxfi"}],["path",{d:"M22 22v-4h-4",key:"1ewp4q"}],["path",{d:"m22 18-1.535 1.605a5 5 0 0 1-8-1.5"

18JSZip v3.10.1 - A JavaScript class for generating and reading zip files

19<http://stuartk.com/jszip>

22Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

24JSZip uses the library pako released under the MIT license :

25https://github.com/nodeca/pako/blob/main/LICENSE

26*/var Dt;function Xr(){return Dt||(Dt=1,(function(M,V){(function(p){M.exports=p()})(function(){return

27\0`,K+=c(z,2),K+=B.magic,K+=c(w,2),K+=c(C,2),K+=c(re.crc32,4),K+=c(re.compressedSize,4),K+=c(re.uncompressedSize,4),K+=c(Z.length,2),K+=c(D.length,2),{fileRecord:_.LOCAL_FILE_HEADER+K+Z+D,dirRecord:_.CENTRAL_FILE_HEADER+c(ne,2)+K+c(ee.length,2)+"\0\0\0\0"+c(E,4)+c(u,4)+Z+D+ee}}var r=p("../utils"),a=p("../stream/GenericWorker"),v=p("../utf8"),y=p("../crc32"),_=p("../signature");function b(n,h,i,u){a.call(this,"ZipFileWorker"),this.bytesWritten=0,this.zipComment=h,this.zipPlatform=i,this.encodeFileName=u,this.streamFiles=n,this.accumulate=!1,this.contentBuffer=[],this.dirRecords=[],this.currentS ...

28`),S=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!p.startsWith("---")||!p.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-YxjrE5b5.jsView on unpkg · L26

30---

32`))return[{path:V,content:M}];const x=[];for(const r of p.split(`

34---

36`))S(r)||x.length===0?x.push(r):x[x.length-1]+=`

38---

40${r}`;if(x.length<2)return[{path:V,content:M}];const c=(r,a)=>{var y,_;return(((_=(y=r.match

41 - a positive number

42 - less than the value passed to \`max\` (or ${xt} if no \`max\` prop is set)

43 - \`null\` or \`undefined\` if the progress is indeterminate.

45Defaulting to \`null\`.`}var Ht=Mt,un=Wt;const qt=se.forwardRef(({className:M,value:V,...p},S)=>s.jsx(Ht,{ref:

Long lines were clipped for display.

dist/web3/assets/MarkdownEditor-CKh4WSn-.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web3/assets/MarkdownEditor-CKh4WSn-.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/web3/assets/page-YxjrE5b5.jsView file

26*/var Dt;function Xr(){return Dt||(Dt=1,(function(M,V){(function(p){M.exports=p()})(function(){return(function p(S,x,c){function o(v,y){if(!x[v]){if(!S[v]){var _=typeof qe=="functi... L27: \0`,K+=c(z,2),K+=B.magic,K+=c(w,2),K+=c(C,2),K+=c(re.crc32,4),K+=c(re.compressedSize,4),K+=c(re.uncompressedSize,4),K+=c(Z.length,2),K+=c(D.length,2),{fileRecord:_.LOCAL_FILE_HEADE... L28: `),S=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!p.startsWith("---")||!p.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-YxjrE5b5.jsView on unpkg · L26

dist/web3/assets/MarkdownEditor-CKh4WSn-.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web3/assets/MarkdownEditor-CKh4WSn-.jsView on unpkg

Findings

1 High3 Medium7 Low

HighSemantic Analysis Limiteddist/web3/assets/MarkdownEditor-CKh4WSn-.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/web3/assets/page-YxjrE5b5.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @promptowl/contextnest-community@1.26.0.

See all versions of @promptowl/contextnest-community for other recorded verdicts.

Review the evidence and your use of @promptowl/contextnest-community@1.26.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 06:37:37.056Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.