1. Resolve the release
The service resolves package metadata from the public npm registry. The first observed release becomes a full baseline. Later releases are compared with the latest completed baseline stored for that package.
2. Collect reviewable evidence
The pipeline records concrete signals before generating any narrative:
- Added, removed, and modified files.
- Package manifest and lifecycle-script changes.
- New executables and paths associated with installation behavior.
- Open advisory context returned by OSV.
- The number of files examined and omitted from the narrative prompt.
3. Generate the narrative
An AI model receives a bounded evidence bundle and produces a summary, risk level, confidence statement, notable findings, and recommended actions. Each report names the provider and model used. The narrative is not treated as source evidence.
4. Preserve limitations
A completed report is decision support, not proof that a package is safe or malicious. Truncated excerpts, omitted files, registry metadata, model behavior, and environmental differences can all change the conclusion. Material findings should be verified against package source and the intended execution environment.