nebula-notebook@0.2.73
AI-native notebook computing environment — real Jupyter kernels, real filesystem, built to be driven by agents (Claude Code / Codex) via MCP
AI Security Review
scanned 25d ago · by lpm-firewall-aiInspection found package-aligned startup, resource reporting, and repository setup behavior, with no concrete attack behavior. The browser bundle's dynamic require loads configured Jupyter settings and does not establish an attack surface.
Decision evidence
public snapshot- The postinstall hook exits when installed beneath node_modules; otherwise it installs dependencies only in existing repository subpackages.
- The launcher starts the bundled server and forwards command-line arguments and the current environment.
- GPU resource collection runs local commands with a timeout and bounded output.
- The browser bundle uses dynamic require to load a configured Jupyter settings file.
- The update checker contacts the npm registry only to compare package versions and report availability; it does not install updates.
Source & flagged code
9 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage contains a possible secret pattern.
dist/assets/index-pBlQK-xI.jsView on unpkg · L826Findings
Affected versions and remediation
This report applies to nebula-notebook@0.2.73.
See all versions of nebula-notebook for other recorded verdicts.
- Review the evidence and your use of nebula-notebook@0.2.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.