registry / Telemetry / privguard-sdk

privguard-sdk

Zero-latency, privacy-safe runtime DPDPA compliance SDK, PII detector, and Express middleware for Node.js

This report shows the evidence for privguard-sdk@1.0.0, the only known version.

AI Security Review

scanned 17h ago · by lpm-firewall-ai

The middleware sends request and query payload fields to its configured service, but its scrubber only handles selected credential keys and known PII patterns. Since the README describes transmission as metadata, the unfiltered fields create an undisclosed collection risk; the behavior is request-triggered and the destination is configurable, so this warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.

Trigger

An application calls `privguard()` and a handled request completes.

Impact

Fields that the scrubber does not recognize can be transmitted without the README’s stated metadata-only limitation.

Mechanism

It combines `req.body` and `req.query`, applies limited PII scrubbing, and posts the resulting payload to the configured PrivGuard endpoint.

AI rationale

Evidence

privguard-middleware.jsREADME.mdpackage.json

Network endpoints1

localhost:5000/api/events/batch (default; host is configurable)

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The middleware combines request body and query fields, then includes the sanitized payload in the event it sends.
It posts events to `/api/events/batch` at a configurable URL, defaulting to `http://localhost:5000`.
The README describes the outbound data as metadata after local PII scrubbing.
The package has no install hook; it exports middleware that runs when an application uses it.

Evidence against

The package’s stated purpose is compliance monitoring, and its README describes asynchronous event batching.
The outbound destination can be configured by the application, and the default is localhost.
The middleware is activated by an application request, not by package installation or import.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 39.1 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

README.mdView file

78patternName = stripe_live_secret severity = critical line = 78

Critical

Critical Secret

Package contains a critical-looking secret pattern.

README.mdView on unpkg · L78

78patternName = stripe_live_secret severity = critical line = 78

Critical

Secret Pattern

Stripe live secret key in README.md

README.mdView on unpkg · L78

privguard-middleware.jsView file

476const rawPayload = { ...(req.body || {}), ...(req.query || {}) }; // Local PII Scrubbing & Fingerprinting before network dispatch const { detectedPII,

Medium

Ai Review Evidence

The middleware combines request body and query fields, then includes the sanitized payload in the event it sends.

privguard-middleware.jsView on unpkg · L476

Findings

2 Critical6 Medium4 Low

CriticalCritical SecretREADME.md

CriticalSecret PatternREADME.md

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidenceprivguard-middleware.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to privguard-sdk@1.0.0.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of privguard-sdk@1.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 05:17:39.071Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownSuspiciousTelemetryWarnPublishedSep 18, 2026, 12:52 PM

registry / Telemetry / privguard-sdk

privguard-sdk

Zero-latency, privacy-safe runtime DPDPA compliance SDK, PII detector, and Express middleware for Node.js

This report shows the evidence for privguard-sdk@1.0.0, the only known version.

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

An application calls `privguard()` and a handled request completes.

Impact

Fields that the scrubber does not recognize can be transmitted without the README’s stated metadata-only limitation.

Mechanism

It combines `req.body` and `req.query`, applies limited PII scrubbing, and posts the resulting payload to the configured PrivGuard endpoint.

AI rationale

Evidence

privguard-middleware.jsREADME.mdpackage.json

Network endpoints1

localhost:5000/api/events/batch (default; host is configurable)

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The middleware combines request body and query fields, then includes the sanitized payload in the event it sends.
It posts events to `/api/events/batch` at a configurable URL, defaulting to `http://localhost:5000`.
The README describes the outbound data as metadata after local PII scrubbing.
The package has no install hook; it exports middleware that runs when an application uses it.

Evidence against

The package’s stated purpose is compliance monitoring, and its README describes asynchronous event batching.
The outbound destination can be configured by the application, and the default is localhost.
The middleware is activated by an application request, not by package installation or import.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 39.1 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

README.mdView file

78patternName = stripe_live_secret severity = critical line = 78

Critical

Critical Secret

Package contains a critical-looking secret pattern.

README.mdView on unpkg · L78

78patternName = stripe_live_secret severity = critical line = 78

Critical

Secret Pattern

Stripe live secret key in README.md

README.mdView on unpkg · L78

privguard-middleware.jsView file

476const rawPayload = { ...(req.body || {}), ...(req.query || {}) }; // Local PII Scrubbing & Fingerprinting before network dispatch const { detectedPII,

Medium

Ai Review Evidence

The middleware combines request body and query fields, then includes the sanitized payload in the event it sends.

privguard-middleware.jsView on unpkg · L476

Findings

2 Critical6 Medium4 Low

CriticalCritical SecretREADME.md

CriticalSecret PatternREADME.md

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidenceprivguard-middleware.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to privguard-sdk@1.0.0.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of privguard-sdk@1.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 05:17:39.071Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownSuspiciousTelemetryWarnPublishedSep 18, 2026, 12:52 PM

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Runtime surface

Behavioral surface