4bnode@4.2.1
4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends identifying machine and project details to the publisher during a narrowly gated, user-run email setup flow. The scope and trigger make this suspicious telemetry rather than an install-time attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicitly running the email setup command and configuring a 4brains.in sender with its authorization password and provider credentials.
Impact
The publisher receives identifying details about the machine and project; the report is not disclosed to the user before sending.
Mechanism
Sends the sender address, OS username, hostname, app name, and timestamp to pawan@4brains.in using the configured Sancharak API or user-selected SMTP service.
AI rationale
The package sends identifying machine and project details to the publisher during a narrowly gated, user-run email setup flow. The scope and trigger make this suspicious telemetry rather than an install-time attack.
Evidence
add-email.jslib/codegen.js.envsrc/services/mailer.js
Network endpoints3
api.sancharak.compawan@4brains.inuser-configured SMTP host
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The email setup flow constructs a report containing the sender address, OS username, hostname, app name, and timestamp.
- After qualifying email setup, the CLI sends the report and then tells the user it was reported.
- The report destination is the package publisher’s fixed address, pawan@4brains.in; the code gates use of the official domain with a shared password.
Evidence against
- The report is sent only during an explicit email setup command when configuring a 4brains.in sender; no install-time or import-time send was identified.
- The Sancharak API key is sent to api.sancharak.com, its own service, and SMTP credentials are used with the SMTP host chosen by the user.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedadd-email.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = 4bnode@4.1.9
matchedIdentity = npm:NGJub2Rl:4.1.9
similarity = 0.771
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
add-email.jsView on unpkg123patternName = generic_password
severity = medium
line = 123
Medium
skeleton/src/discovery.jsView file
34import os from "os";
L35: import { execFileSync } from "child_process";
L36:
High
Child Process
Package source references child process execution.
skeleton/src/discovery.jsFindings
1 Critical5 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltaadd-email.js
HighChild Processskeleton/src/discovery.js
HighShell
HighCross File Remote Execution Contextlib/codegen.test.js
HighRuntime Package Installindex.js
HighSemantic Analysis Limitedlib/codegen.test.js#virtual:string-array:round1
MediumSecret Patternadd-email.js
MediumDynamic Requireadd-bonjour.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to 4bnode@4.2.1.
See all versions of 4bnode for other recorded verdicts.
- Review the evidence and your use of 4bnode@4.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.