registry / Data exfiltration / @promptowl/contextnest-community / 2.1.0

@promptowl/contextnest-community@2.1.0

ContextNest Community Edition — self-hosted context governance server for AI workflows. Commercial software by Promptowl LLC.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The unresolved runtime hints resolve to formatting and digest-buffer operations, while the verified privacy risk is conditional telemetry that can include user email addresses. The vendor-aligned recipient and license-key requirement weigh against a malicious verdict but do not remove the identifying-data disclosure.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Server startup starts the telemetry loop; sending occurs when telemetry is enabled and a PromptOwl license key is configured.

Impact

Identifying account data and usage metadata may be disclosed to the telemetry recipient.

Mechanism

The sender enriches events with stored user emails and posts usage statistics and events to the configured telemetry endpoint.

AI rationale

Evidence

dist/index.jsdist/chunk-LSDNAQQD.jsdist/chunk-NXRP3TBJ.js

Network endpoints1

app.promptowl.ai/api/telemetry/ingest

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The published entrypoint starts telemetry at server startup; the telemetry loop is enabled unless TELEMETRY_ENABLED is set to false.
Telemetry flushes only when enabled and PROMPTOWL_KEY is configured, then posts usage events to the configured PromptOwl API URL, which defaults to app.promptowl.ai.
The telemetry sender looks up stored user email addresses and adds them to event data; the user-registration event includes an email address.
The reviewed runtime-operation locations perform array/string formatting and buffered digest handling; they do not establish an account action or a separate attack surface.

Evidence against

The recipient is the vendor’s PromptOwl telemetry service by default, and transmission requires a configured license key; this supports ordinary product telemetry, though it does not remove the identifying-data disclosure.

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

Source & flagged code

10 flagged

dist/web3/assets/page-DElCc_fS.jsView file

Lines 6-46javascript

6 */const Hr=[["rect",{width:"20",height:"5",x:"2",y:"3",rx:"1",key:"1wp1u1"}],["path",{d:"M4 8v11a2 2 0 0 0 2 2h2",key:"tvwodi"}],["path",{d:"M20 8v11a2 2 0 0 1-2 2h-2",key:"1gkqxj"}],["path",{d:"m9 15 3-3 3 3",key:"1pd0qc"}],["path",{d:"M12 12v9",key:"192myk"}]],qr=gt("archive-restore",Hr);/**

7 * @license lucide-react v0.577.0 - ISC

8 *

9 * This source code is licensed under the ISC license.

10 * See the LICENSE file in the root directory of this source tree.

11 */const Gr=[["path",{d:"M17 3a2 2 0 0 1 2 2v15a1 1 0 0 1-1.496.868l-4.512-2.578a2 2 0 0 0-1.984 0l-4.512 2.578A1 1 0 0 1 5 20V5a2 2 0 0 1 2-2z",key:"oz39mx"}]],Kr=gt("bookmark",Gr);/**

12 * @license lucide-react v0.577.0 - ISC

13 *

14 * This source code is licensed under the ISC license.

15 * See the LICENSE file in the root directory of this source tree.

16 */const Yr=[["path",{d:"M9 20H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H20a2 2 0 0 1 2 2v.5",key:"1dkoa9"}],["path",{d:"M12 10v4h4",key:"1czhmt"}],["path",{d:"m12 14 1.535-1.605a5 5 0 0 1 8 1.5",key:"lvuxfi"}],["path",{d:"M22 22v-4h-4",key:"1ewp4q"}],["path",{d:"m22 18-1.535 1.605a5 5 0 0 1-8-1.5"

18JSZip v3.10.1 - A JavaScript class for generating and reading zip files

19<http://stuartk.com/jszip>

22Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

24JSZip uses the library pako released under the MIT license :

25https://github.com/nodeca/pako/blob/main/LICENSE

26*/var Ft;function nn(){return Ft||(Ft=1,(function(M,V){(function(m){M.exports=m()})(function(){return

27\0`,K+=c(I,2),K+=P.magic,K+=c(w,2),K+=c(S,2),K+=c(se.crc32,4),K+=c(se.compressedSize,4),K+=c(se.uncompressedSize,4),K+=c(W.length,2),K+=c(R.length,2),{fileRecord:g.LOCAL_FILE_HEADER+K+W+R,dirRecord:g.CENTRAL_FILE_HEADER+c(ee,2)+K+c(te.length,2)+"\0\0\0\0"+c(E,4)+c(h,4)+W+R+te}}var r=m("../utils"),o=m("../stream/GenericWorker"),_=m("../utf8"),y=m("../crc32"),g=m("../signature");function b(i,u,n,h){o.call(this,"ZipFileWorker"),this.bytesWritten=0,this.zipComment=u,this.zipPlatform=n,this.encodeFileName=h,this.streamFiles=i,this.accumulate=!1,this.contentBuffer=[],this.dirRecords=[],this.currentS ...

28`),C=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!m.startsWith("---")||!m.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-DElCc_fS.jsView on unpkg · L26

30---

32`))return[{path:V,content:M}];const v=[];for(const r of m.split(`

34---

36`))C(r)||v.length===0?v.push(r):v[v.length-1]+=`

38---

40${r}`;if(v.length<2)return[{path:V,content:M}];const c=(r,o)=>{var y,g;return(((g=(y=r.match

41 - a positive number

42 - less than the value passed to \`max\` (or ${vt} if no \`max\` prop is set)

43 - \`null\` or \`undefined\` if the progress is indeterminate.

45Defaulting to \`null\`.`}var Vt=qt,xn=Kt;const Xt=ne.forwardRef(({className:M,value:V,...m},C)=>s.jsx(Vt,{ref:

Long lines were clipped for display.

dist/chunk-FUFXYQB3.jsView file

Lines 87-127javascript

87 this.name = "LockedError";

88 }

89};

90var VaultBusyError = class extends AppError {

91 retryAfterSeconds =

dist/web3/assets/MarkdownEditor-BKEJU67b.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web3/assets/MarkdownEditor-BKEJU67b.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @promptowl/contextnest-community@2.0.0 matchedPath = dist/web3/assets/MarkdownEditor-B_i-QP_G.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web3/assets/MarkdownEditor-BKEJU67b.jsView on unpkg

dist/chunk-K7ETWAY5.jsView file

•matchType = normalized_sha256 matchedPackage = @promptowl/contextnest-community@2.0.0 matchedPath = dist/chunk-K7ETWAY5.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-K7ETWAY5.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @promptowl/contextnest-community@1.29.1 matchedIdentity = npm:[redacted]:1.29.1 similarity = 0.573 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-K7ETWAY5.jsView on unpkg

dist/chunk-JTP4OITR.jsView file

•matchType = normalized_sha256 matchedPackage = @promptowl/contextnest-community@2.0.0 matchedPath = dist/chunk-QSZFVM5F.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-JTP4OITR.jsView on unpkg

dist/chunk-PRAOBOAH.jsView file

•matchType = token_shingles matchedPackage = @promptowl/contextnest-community@2.0.0 matchedPath = dist/chunk-S23DULBZ.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-PRAOBOAH.jsView on unpkg

dist/egress-PB2MVEVM.jsView file

•matchType = normalized_sha256 matchedPackage = @promptowl/contextnest-community@2.0.0 matchedPath = dist/egress-HBLWTSG4.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/egress-PB2MVEVM.jsView on unpkg

dist/web3/assets/module-uADzTImp.jsView file

•matchType = normalized_sha256 matchedPackage = @promptowl/contextnest-community@2.0.0 matchedPath = dist/web3/assets/module-uADzTImp.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web3/assets/module-uADzTImp.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/web3/assets/page-DElCc_fS.jsView file

26*/var Ft;function nn(){return Ft||(Ft=1,(function(M,V){(function(m){M.exports=m()})(function(){return(function m(C,v,c){function a(_,y){if(!v[_]){if(!C[_]){var g=typeof Ge=="functi... L27: \0`,K+=c(I,2),K+=P.magic,K+=c(w,2),K+=c(S,2),K+=c(se.crc32,4),K+=c(se.compressedSize,4),K+=c(se.uncompressedSize,4),K+=c(W.length,2),K+=c(R.length,2),{fileRecord:g.LOCAL_FILE_HEADE... L28: `),C=r=>/^---\n[\s\S]*?\n---\n/.test(r);if(!m.startsWith("---")||!m.includes(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web3/assets/page-DElCc_fS.jsView on unpkg · L26

dist/chunk-FUFXYQB3.jsView file

107Source sends the broad process environment to a literal external destination. L107: var SERVICE_VERSION = (() => { L108: for (const up of [["..", "package.json"], ["..", "..", "package.json"]]) { L109: try { L110: const pkg = JSON.parse(readFileSync(join(HERE, ...up), "utf8")); L111: if (pkg?.name === "@promptowl/contextnest-community") { ... L180: async function masterKey() { L181: const fromEnv = (process.env.SECRETS_KEY || "").trim(); L182: if (fromEnv) { ... L271: var DEFAULT_LICENSE_CONTACT = { L272: url: "https://calendar.app.google/u2z8xh5PqDjQJih78", L273: email: "support@promptowl.ai" ... L336: headers: config.PROMPTOWL_FETCH_HEADERS,

Findings

1 Critical8 High3 Medium7 Low

CriticalHardcoded Runtime Data Exfiltrationdist/chunk-FUFXYQB3.js

HighSemantic Analysis Limiteddist/web3/assets/MarkdownEditor-BKEJU67b.js

HighKnown Malware Source Similaritydist/chunk-K7ETWAY5.js

HighKnown Malware Source Similaritydist/web3/assets/MarkdownEditor-BKEJU67b.js

HighKnown Malware Source Similaritydist/chunk-JTP4OITR.js

HighKnown Malware Source Similaritydist/chunk-PRAOBOAH.js

HighKnown Malware Source Similaritydist/egress-PB2MVEVM.js

HighKnown Malware Source Similaritydist/web3/assets/module-uADzTImp.js

HighPrevious Version Dangerous Deltadist/chunk-K7ETWAY5.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @promptowl/contextnest-community@2.1.0.

See all versions of @promptowl/contextnest-community for other recorded verdicts.

Review the evidence and your use of @promptowl/contextnest-community@2.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 08:49:08.479Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code