privguard-sdk@1.0.0
Zero-latency, privacy-safe runtime DPDPA compliance SDK, PII detector, and Express middleware for Node.js
AI Security Review
scanned 17h ago · by lpm-firewall-aiThe middleware sends request and query payload fields to its configured service, but its scrubber only handles selected credential keys and known PII patterns. Since the README describes transmission as metadata, the unfiltered fields create an undisclosed collection risk; the behavior is request-triggered and the destination is configurable, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The middleware combines request body and query fields, then includes the sanitized payload in the event it sends.
- It posts events to `/api/events/batch` at a configurable URL, defaulting to `http://localhost:5000`.
- The README describes the outbound data as metadata after local PII scrubbing.
- The package has no install hook; it exports middleware that runs when an application uses it.
- The package’s stated purpose is compliance monitoring, and its README describes asynchronous event batching.
- The outbound destination can be configured by the application, and the default is localhost.
- The middleware is activated by an application request, not by package installation or import.
Source & flagged code
6 flaggedThe middleware combines request body and query fields, then includes the sanitized payload in the event it sends.
privguard-middleware.jsView on unpkg · L476Findings
Affected versions and remediation
This report applies to privguard-sdk@1.0.0.
See all versions of privguard-sdk for other recorded verdicts.
- Review the evidence and your use of privguard-sdk@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.