registry / nebula-notebook / 0.2.87
nebula-notebook@0.2.87
AI-native notebook computing environment — real Jupyter kernels, real filesystem, built to be driven by agents (Claude Code / Codex) via MCP
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook is skipped for npm dependency installs and confines its work to existing repository subprojects. The startup request is a package-aligned version lookup at the npm registry; the inspected source does not show identifying data beyond the ordinary request or transfer of local contents or credentials.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The install hook runs during installation; the update check starts with the server and repeats daily unless disabled by its environment setting.
Impact
No unrelated installation tracking, credential transfer, or other confirmed attack impact was established.
Mechanism
The hook installs dependencies only in existing repository subdirectories and skips when installed under node_modules. The server requests the package's latest version from the npm registry without sending package files or credentials.
AI rationale
The postinstall hook is skipped for npm dependency installs and confines its work to existing repository subprojects. The startup request is a package-aligned version lookup at the npm registry; the inspected source does not show identifying data beyond the ordinary request or transfer of local contents or credentials.
Network endpoints1
registry.npmjs.org/nebula-notebook/latest
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to the launcher and defines a postinstall hook; the hook skips installs from node_modules and runs npm only in existing repository subdirectories.
- At server startup, the update checker makes a version-check request to the npm registry, compares versions, and supports an environment-variable opt-out.
- The launcher starts the packaged server with the user's arguments and environment.
- The inspected bundles contain UI behavior and dynamic-code generation patterns; the latter appear in bundled code-generation helpers.
- The inspected dependency snapshots are Fastify CORS, multipart, and static-serving packages.
- The inspected server modules handle authentication, file discovery, notebook edits, ARM setup, remote identity setup, and bounded resource commands.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/assets/index-pBlQK-xI.jsView file
826patternName = generic_password
severity = medium
line = 826
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/assets/index-pBlQK-xI.jsView on unpkg · L826Findings
6 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/nebula-notebook.js
HighShellnode-server/dist/resources/resource-service.js
HighCross File Remote Execution Contextbin/nebula-notebook.js
HighRuntime Package Installscripts/postinstall.cjs
HighSemantic Analysis Limiteddist/assets/index-BdZ_Kjti.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patterndist/assets/index-pBlQK-xI.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/assets/index-BdZ_Kjti.js
Affected versions and remediation
This report applies to nebula-notebook@0.2.87.
See all versions of nebula-notebook for other recorded verdicts.
- Review the evidence and your use of nebula-notebook@0.2.87 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.