@bongos/core@1.19.963
Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe devcontainer script performs a concrete, broad agent permission change that warrants a warning. The package manifest has no lifecycle hook, so the inspected evidence does not support blocking it as an npm install attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Devcontainer post-create provisioning runs.
Impact
Claude Code may run without its normal permission prompts in that user environment.
Mechanism
The script edits ~/.claude/settings.json and sets permissions.defaultMode to bypassPermissions.
AI rationale
The devcontainer script performs a concrete, broad agent permission change that warrants a warning. The package manifest has no lifecycle hook, so the inspected evidence does not support blocking it as an npm install attack.
Evidence
.devcontainer/post-create.sh~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The devcontainer post-create script writes Claude Code's user settings and sets the default permission mode to bypass prompts.
- The manifest has no npm lifecycle hook, so the change is not shown to run during package installation.
Evidence against
- The permission change is in a devcontainer provisioning script, not an npm lifecycle hook.
- The inspected CLI dispatches package scripts when invoked and does not itself establish an install-time trigger.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
CopyleftLicense
Source & flagged code
25 flagged · loading sourcetests/public_mirror_export.mjsView file
103patternName = aws_access_key
severity = critical
line = 103
Critical
Critical Secret
Package contains a critical-looking secret pattern.
tests/public_mirror_export.mjsView on unpkg · L103103patternName = aws_access_key
severity = critical
line = 103
Critical
Secret Pattern
AWS access key ID in tests/public_mirror_export.mjs
tests/public_mirror_export.mjsView on unpkg · L103bin/bongos.jsView file
21const path = require('node:path');
L22: const { spawnSync } = require('node:child_process');
L23:
High
20L21: const path = require('node:path');
L22: const { spawnSync } = require('node:child_process');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/bongos.jsView on unpkg · L20scripts/setup-builder.jsView file
71// and never spread from caller-supplied opts: shell:true on Windows runs the
L72: // args through cmd.exe expansion, so it's used ONLY for `npm` (a .cmd shim that
L73: // can't be spawned without a shell) and ONLY with hardcoded args — never with
High
public-docs/redoc.standalone.jsView file
8patternName = generic_password
severity = medium
line = 8
Medium
Secret Pattern
Hardcoded password in public-docs/redoc.standalone.js
public-docs/redoc.standalone.jsView on unpkg · L81/*! For license information please see redoc.standalone.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("null")):"function"==typeof define&&define.amd?define(["null"],t):"object"==typeof exports...
L3: || (${a} == "string" && ${i} && ${i} == +${i})`).assign(l,s._`+${i}`);case"integer":return void n.elseIf(s._`${a} === "boolean" || ${i} === null
Low
Eval
Package source references a known benign dynamic code generation pattern.
public-docs/redoc.standalone.jsView on unpkg · L1tests/hall_profile_world.mjsView file
38// node modules/ui-design/kit/render.js --states modules/hall-ui/public/profile.states.json \
L39: // --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621
L40:
...
L169: },
L170: console, Date, Map, Set, Math, Number, String, Array, Infinity, URLSearchParams,
L171: };
...
L184: // deep-equal against a literal here fails on identity alone; compare the data.
L185: const plain = (v) => JSON.parse(JSON.stringify(v));
L186:
...
L354: assert.ok(own.mount.innerHTML.includes('id="chart-rate"'), 'and the pace chart draws');
L355: assert.ok(own.mount.innerHTML.includes('only you see this one'), 'saying plainly that it is private');
L356: });
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
tests/hall_profile_world.mjsView on unpkg · L38scripts/gds/fitness-ratchets.jsView file
246knipSkipReason = `no knip in ${path.join(ROOT, 'node_modules')} — `
L247: + 'npx would resolve one from outside this tree and report it as an unlisted '
L248: + 'binary, scoring one higher than the same code scores in CI (task 1003987)';
...
L252: try {
L253: raw = execSync('npx --no-install knip --reporter json --no-exit-code', {
L254: cwd: ROOT, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/gds/fitness-ratchets.jsView on unpkg · L24639const crypto = require('crypto');
L40: const { execFileSync, execSync } = require('child_process');
L41:
L42: const ROOT = path.resolve(__dirname, '..', '..');
L43: const BASELINE_PATH = path.join(ROOT, 'config', 'fitness-baselines.json');
...
L89: for (let i = 0; i + window <= lines.length; i++) {
L90: const h = crypto.createHash('sha1').update(lines.slice(i, i + window).join('\n')).digest('base64');
L91: let set = filesByHash.get(h);
...
L208: // main checkout (knip local) -> 221
L209: // worktree (knip ambient) -> 222, the extra being `binaries: package.json knip`
L210: // Diffed by name, the exports lists were IDENTICAL (221 both sides). knip was
...
L256: } catch (e) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
scripts/gds/fitness-ratchets.jsView on unpkg · L39modules/ui-design/kit/serve.jsView file
27// Exit 2 on a surface that does not resolve. Prints ONE line when listening
L28: // ("stub on http://…") — render.js and probe.js wait for it.
L29: const http = require('node:http');
...
L33: const crypto = require('node:crypto');
L34: const { spawnSync } = require('node:child_process');
L35: const lib = require('./lib.js');
L36:
L37: const ROOT = process.env.STUB_REPO ? path.resolve(process.env.STUB_REPO) : lib.REPO_ROOT;
L38: const SURFACE = process.env.SURFACE || 'public-landing';
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
modules/ui-design/kit/serve.jsView on unpkg · L27scripts/gds/build-bongos.jsView file
24const path = require('node:path');
L25: const { spawnSync } = require('node:child_process');
L26: const { arg } = require('./cli-lib');
L27:
L28: const REPO_ROOT = path.join(__dirname, '..', '..');
L29: const ENTRY = path.join(REPO_ROOT, 'bin', 'bongos.js');
...
L42: function bunPresent() {
L43: const r = spawnSync('bun', ['--version'], { encoding: 'utf8', shell: process.platform === 'win32' });
L44: return !!r && !r.error && r.status === 0;
...
L66: console.error('✖ `bun` is required to compile the standalone binary but was not found.');
L67: console.error(' Install it (https://bun.sh) — e.g. `curl -fsSL https://bun.sh/install | bash` —');
L68: console.error(' or in CI use the oven-sh/setup-bun action. Then re-run.');
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/gds/build-bongos.jsView on unpkg · L24modules/security/artifact-scan/fetch.jsView file
10L11: const dns = require('node:dns');
L12: const fsp = require('node:fs/promises');
L13: const path = require('node:path');
L14: const { spawn } = require('node:child_process');
L15:
...
L19: const MAX_CAPTURE_BYTES = 1 * 1024 * 1024;
L20: // git's stderr can name internal hosts and paths; only a short excerpt travels,
L21: // and only in a finding's detail, never in a message a caller might echo.
...
L50: if (a === 0) return 'the unspecified range';
L51: if (a === 10) return 'a private (RFC 1918) address';
L52: if (a === 172 && b >= 16 && b <= 31) return 'a private (RFC 1918) address';
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
modules/security/artifact-scan/fetch.jsView on unpkg · L10tests/grader_prompt_fencing.mjsView file
74contains invisible/control Unicode U+202E (right-to-left override)
const dirty = `a${'<U+202E>'}b${'<U+202D>'}c${'<U+202A>'}d`;
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
tests/grader_prompt_fencing.mjsView on unpkg · L74.devcontainer/post-create.shView file
•path = .devcontainer/post-create.sh
kind = payload_in_excluded_dir
sizeBytes = 7543
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.devcontainer/post-create.shView on unpkg•path = .devcontainer/post-create.sh
kind = build_helper
sizeBytes = 7543
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
.devcontainer/post-create.shView on unpkgmodules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 82
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View on unpkgscripts/gds/cli-lib.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @bongos/core@1.19.740
matchedIdentity = npm:QGJvbmdvcy9jb3Jl:1.19.740
similarity = 0.517
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/gds/cli-lib.jsView on unpkgtests/audit_middleware.mjsView file
365patternName = generic_password
severity = medium
line = 365
Medium
Secret Pattern
Hardcoded password in tests/audit_middleware.mjs
tests/audit_middleware.mjsView on unpkg · L365tests/provision.mjsView file
2976patternName = generic_password
severity = medium
line = 2976
Medium
3014patternName = generic_password
severity = medium
line = 3014
Medium
tests/auto_merge_diagnosis.mjsView file
297patternName = github_pat
severity = critical
line = 297
Critical
Secret Pattern
GitHub personal access token in tests/auto_merge_diagnosis.mjs
tests/auto_merge_diagnosis.mjsView on unpkg · L297tests/logger.mjsView file
62patternName = github_pat
severity = critical
line = 62
Critical
tests/secret_gate.mjsView file
21patternName = github_pat
severity = critical
line = 21
Critical
Secret Pattern
GitHub personal access token in tests/secret_gate.mjs
tests/secret_gate.mjsView on unpkg · L21tests/key-status.mjsView file
25patternName = google_api_key
severity = high
line = 25
High
Findings
7 Critical9 High10 Medium7 Low
CriticalCritical Secrettests/public_mirror_export.mjs
CriticalTrojan Source Unicodetests/grader_prompt_fencing.mjs
CriticalPrevious Version Dangerous Deltascripts/gds/cli-lib.js
CriticalSecret Patterntests/public_mirror_export.mjs
CriticalSecret Patterntests/auto_merge_diagnosis.mjs
CriticalSecret Patterntests/logger.mjs
CriticalSecret Patterntests/secret_gate.mjs
HighChild Processbin/bongos.js
HighShellscripts/setup-builder.js
HighSame File Env Network Executionmodules/ui-design/kit/serve.js
HighSandbox Evasion Gated Capabilityscripts/gds/build-bongos.js
HighCloud Metadata Accessmodules/security/artifact-scan/fetch.js
HighRuntime Package Installscripts/gds/fitness-ratchets.js
HighPayload In Excluded Dir.devcontainer/post-create.sh
HighSemantic Analysis Limitedmodules/autonomy/pollers/routine-timers.js#virtual:normalized:round1
HighSecret Patterntests/key-status.mjs
MediumDynamic Requirebin/bongos.js
MediumUnsafe Vm Contexttests/hall_profile_world.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helper.devcontainer/post-create.sh
MediumStructural Risk Force Deep Review
MediumSecret Patternpublic-docs/redoc.standalone.js
MediumSecret Patterntests/audit_middleware.mjs
MediumSecret Patterntests/provision.mjs
MediumSecret Patterntests/provision.mjs
LowEvalpublic-docs/redoc.standalone.js
LowWeak Cryptoscripts/gds/fitness-ratchets.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @bongos/core@1.19.963.
See all versions of @bongos/core for other recorded verdicts.
- Review the evidence and your use of @bongos/core@1.19.963 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.