registry / @promptowl/contextnest-community / 1.27.0

@promptowl/contextnest-community@1.27.0

⚠ Under review

ContextNest Community Edition — self-hosted context governance server for AI workflows. Commercial software by Promptowl LLC.

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 79 file(s), 3.95 MB of source, external domains: accounts.google.com, acme.example.com, adaptivecards.io, app.posthog.com, app.promptowl.ai, claude.ai, claude.com, code.claude.com, community.example.com, cursor.com, developers.openai.com, docs.x.ai, example.com, github.com, grok.com, hermes-agent.nousresearch.com, hooks.slack.com, json-schema.org, learn.chatgpt.com, login.microsoftonline.com, nest.acme.com, nest.example.com, nest.yourcompany.com, nodejs.org, player.vimeo.com, posthog.com, promptowl.ai, prosemirror.net, radix-ui.com, reactjs.org, sentry.io, stuk.github.io, us.i.posthog.com, us.posthog.com, www.npmjs.com, www.perplexity.ai, www.w3.org, www.youtube-nocookie.com, www.youtube.com, yandex.com

Source & flagged code

2 flagged

dist/web3/assets/page-DTjPQizZ.jsView file

Lines 6-46javascript

6 */const Zr=[["rect",{width:"20",height:"5",x:"2",y:"3",rx:"1",key:"1wp1u1"}],["path",{d:"M4 8v11a2 2 0 0 0 2 2h2",key:"tvwodi"}],["path",{d:"M20 8v11a2 2 0 0 1-2 2h-2",key:"1gkqxj"}],["path",{d:"m9 15 3-3 3 3",key:"1pd0qc"}],["path",{d:"M12 12v9",key:"192myk"}]],$r=gt("archive-restore",Zr);/**

7 * @license lucide-react v0.577.0 - ISC

8 *

9 * This source code is licensed under the ISC license.

10 * See the LICENSE file in the root directory of this source tree.

11 */const Hr=[["path",{d:"M17 3a2 2 0 0 1 2 2v15a1 1 0 0 1-1.496.868l-4.512-2.578a2 2 0 0 0-1.984 0l-4.512 2.578A1 1 0 0 1 5 20V5a2 2 0 0 1 2-2z",key:"oz39mx"}]],qr=gt("bookmark",Hr);/**

12 * @license lucide-react v0.577.0 - ISC

13 *

14 * This source code is licensed under the ISC license.

15 * See the LICENSE file in the root directory of this source tree.

16 */const Gr=[["path",{d:"M9 20H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H20a2 2 0 0 1 2 2v.5",key:"1dkoa9"}],["path",{d:"M12 10v4h4",key:"1czhmt"}],["path",{d:"m12 14 1.535-1.605a5 5 0 0 1 8 1.5",key:"lvuxfi"}],["path",{d:"M22 22v-4h-4",key:"1ewp4q"}],["path",{d:"m22 18-1.535 1.605a5 5 0 0 1-8-1.5"

18JSZip v3.10.1 - A JavaScript class for generating and reading zip files

19<http://stuartk.com/jszip>

22Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

24JSZip uses the library pako released under the MIT license :

25https://github.com/nodeca/pako/blob/main/LICENSE

26*/var Ot;function rn(){return Ot||(Ot=1,(function(M,V){(function(m){M.exports=m()})(function(){return

27\0`,Y+=c(I,2),Y+=B.magic,Y+=c(w,2),Y+=c(S,2),Y+=c(se.crc32,4),Y+=c(se.compressedSize,4),Y+=c(se.uncompressedSize,4),Y+=c(W.length,2),Y+=c(O.length,2),{fileRecord:g.LOCAL_FILE_HEADER+Y+W+O,dirRecord:g.CENTRAL_FILE_HEADER+c(te,2)+Y+c(ee.length,2)+"\0\0\0\0"+c(E,4)+c(h,4)+W+O+ee}}var r=m("../utils"),o=m("../stream/GenericWorker"),_=m("../utf8"),y=m("../crc32"),g=m("../signature");function b(i,u,n,h){o.call(this,"ZipFileWorker"),this.bytesWritten=0,this.zipComment=u,this.zipPlatform=n,this.encodeFileName=h,this.streamFiles=i,this.accumulate=!1,this.contentBuffer=[],this.dirRecords=[],this.currentS ...

28`),C=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!m.startsWith("---")||!m.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-DTjPQizZ.jsView on unpkg · L26

30---

32`))return[{path:V,content:M}];const v=[];for(const r of m.split(`

34---

36`))C(r)||v.length===0?v.push(r):v[v.length-1]+=`

38---

40${r}`;if(v.length<2)return[{path:V,content:M}];const c=(r,o)=>{var y,g;return(((g=(y=r.match

41 - a positive number

42 - less than the value passed to \`max\` (or ${vt} if no \`max\` prop is set)

43 - \`null\` or \`undefined\` if the progress is indeterminate.

45Defaulting to \`null\`.`}var Kt=$t,gn=qt;const Yt=ne.forwardRef(({className:M,value:V,...m},C)=>s.jsx(Kt,{ref:

Long lines were clipped for display.

dist/web3/assets/MarkdownEditor-BELFww9q.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web3/assets/MarkdownEditor-BELFww9q.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/web3/assets/page-DTjPQizZ.jsView file

26*/var Ot;function rn(){return Ot||(Ot=1,(function(M,V){(function(m){M.exports=m()})(function(){return(function m(C,v,c){function a(_,y){if(!v[_]){if(!C[_]){var g=typeof Ge=="functi... L27: \0`,Y+=c(I,2),Y+=B.magic,Y+=c(w,2),Y+=c(S,2),Y+=c(se.crc32,4),Y+=c(se.compressedSize,4),Y+=c(se.uncompressedSize,4),Y+=c(W.length,2),Y+=c(O.length,2),{fileRecord:g.LOCAL_FILE_HEADE... L28: `),C=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!m.startsWith("---")||!m.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-DTjPQizZ.jsView on unpkg · L26

dist/web3/assets/MarkdownEditor-BELFww9q.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web3/assets/MarkdownEditor-BELFww9q.jsView on unpkg

Findings

1 High3 Medium7 Low

HighSemantic Analysis Limiteddist/web3/assets/MarkdownEditor-BELFww9q.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/web3/assets/page-DTjPQizZ.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @promptowl/contextnest-community@1.27.0.

See all versions of @promptowl/contextnest-community for other recorded verdicts.

Review the evidence and your use of @promptowl/contextnest-community@1.27.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 04:58:46.368Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.