Node Base reports#

Node Base writes JSON reports for CI checks and Markdown reports for reviewers. Use them to inspect what an install did and decide whether a finding needs attention.

Report directory#

Reports go to:

.mezair/reports

Override the directory with:

MEZAIR_REPORT_DIR=/tmp/mezair-reports mezair-dep-report

Dependency report#

Generate a report from an existing install:

mezair-dep-report

This scans node_modules, lifecycle scripts, package metadata, and package-name signals where registry data is available.

Network monitor#

Run any command with network syscall monitoring:

mezair-network-monitor -- npm test

This writes:

• network-strace.log
• network-report.json
• network-report.md

Use this for commands other than dependency installation when you still want outbound connection evidence.

Risk gate#

Apply strict-mode policy to a report:

MEZAIR_STRICT=true mezair-risk-gate .mezair/reports/ioc-report.json ioc

Report types:

Submitting reports#

Submit reports to Mezair Registry/Admin:

MEZAIR_REGISTRY_URL=http://localhost:4873 \
MEZAIR_ADMIN_TOKEN=local-dev-token \
MEZAIR_PROJECT_NAME=my-project \
MEZAIR_REPORT_SOURCE=ci \
  mezair-submit-report .mezair/reports/network-report.json network

Submission lets teams review Node Base findings in the same place they review registry decisions and overrides.

Redaction#

Environment snapshots redact values for variable names that look credential-bearing, such as:

• TOKEN
• SECRET
• PASSWORD
• PRIVATE
• CREDENTIAL
• AUTH
• COOKIE
• SESSION
• DATABASE_URL
• KEY

Do not treat redaction as permission to dump secrets into logs. Redaction reduces damage; it does not make bad hygiene holy.