registry / @bongos/core / 1.20.25

@bongos/core@1.20.25

Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The manifest has no install lifecycle hooks, and inspected runtime findings map to ordinary CLI, metrics, test, and lint behavior. The scanner hints do not establish a concrete attack in source.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Normal package import or a user-run CLI command; the inspected skill-lint hook runs when configured or explicitly invoked.

Impact

No confirmed attack surface was established by these source excerpts.

Mechanism

The reviewed runtime matches normalize request paths and collect metrics, while skill-lint checks a changed skill file and prints findings. No credential transfer, lifecycle mutation, or unconsented agent-control change was established.

AI rationale

The manifest has no install lifecycle hooks, and inspected runtime findings map to ordinary CLI, metrics, test, and lint behavior. The scanner hints do not establish a concrete attack in source.

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines package entry points and ordinary runtime dependencies but no lifecycle scripts; the inspected skill-lint hook only reads a touched skill file and prints lint results.
The flagged runtime excerpts perform route normalization and metric handling, while the skill-lint account-action match is console output from an explicitly invoked or configured hook.
The reviewed agent-related excerpts concern project documentation, worktree detection, transcript paths, CLI materialization, and generated module files; they do not establish an unconsented foreign agent configuration change.

Evidence against

Static hints flag dynamic loading, child-process use, a secret-like test fixture, Unicode in a prompt-fencing test, and a runtime package-manager call; source context identifies normal CLI, tests, and quality tooling rather than a package install attack.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

23 flagged

tests/public_mirror_export.mjsView file

103patternName = aws_access_key severity = critical line = 103

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/public_mirror_export.mjsView on unpkg · L103

103patternName = aws_access_key severity = critical line = 103

Critical

Secret Pattern

AWS access key ID in tests/public_mirror_export.mjs

tests/public_mirror_export.mjsView on unpkg · L103

bin/bongos.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// bin/bongos.js — the Cloud Bongos CLI dispatcher.

3//

4// GDS-V4 · V4.R79 · task 1246 (Phase 1 of the `bongos` toolkit; epic 1245).

5//

6// A single `bongos <verb>` front door over the existing scripts/gds/* scripts —

7// the same actions the /builder-* slash-commands run inside Claude Code, now

8// usable from any terminal, VS Code, a Chromebook, or CI. This is deliberately a

9// THIN dispatcher: it spawns the target script with `process.execPath` (the one

10// guaranteed cross-platform runtime — no bash, #686) and forwards argv + exit

11// code. No auth/API logic lives here; the target scripts already share

12// scripts/gds/cli-lib.js.

13//

14// Phases 2-4 extend this same CLI with a one-line installer + standalone binary

15// and instance-agnostic `login`/`init`/`upgrade`.

17'use strict';

19const path = require('node:path');

20const { spawnSync } = require('node:child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bongos.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

bin/bongos.jsView on unpkg · L19

22const REPO_ROOT = path.join(__dirname, '..');

23const GDS_DIR = path.join(REPO_ROOT, 'scripts', 'gds');

25// Two runtimes, one dispatcher (V4.R81 / task 1248):

26// • repo checkout / `npm i -g` → we run under `node`, and the sibling scripts

27// are on disk beside us: spawn each under node (the original path).

28// • compiled standalone binary (the `curl | sh` install — no Node, no repo) →

29// process.execPath is the `bongos` binary itself, not node/bun, so there is

30// nothing to spawn and no scripts on disk. The ON-RAMP verbs' scripts are

31// bundled into the binary and run in-process (see BUNDLED_RUNNERS).

32// We distinguish by the basename of the running executable — a compiled binary

33// is named `bongos`, never `node`/`bun`.

34const EXEC_BASENAME = path.basename(process.execPath).toLowerCase();

35const COMPILED = !['node', 'node.exe', 'bun', 'bun.exe'].includes(EXEC_BASENAME);

37// The verbs whose scripts are bundled into the standalone binary: just enough to

38// get a user from a bare laptop onto a real environment. Each value is a LAZY

39// require — never evaluated in the spawn (repo/npm) path, so requiring bongos.js

scripts/setup-builder.jsView file

Lines 51-91javascript

51 process.exit(0);

52 } else {

53 console.error(`Unknown argument: ${a}`);

54 console.error('Run with --help for usage.');

55 process.exit

public-docs/redoc.standalone.jsView file

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Hardcoded password in public-docs/redoc.standalone.js

public-docs/redoc.standalone.jsView on unpkg · L8

1/*! For license information please see redoc.standalone.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("null")):"function"==typeof define&&define.amd?define(["null"],t):"object"==typeof exports... L3: || (${a} == "string" && ${i} && ${i} == +${i})`).assign(l,s._`+${i}`);case"integer":return void n.elseIf(s._`${a} === "boolean" || ${i} === null

Low

Eval

Package source references a known benign dynamic code generation pattern.

public-docs/redoc.standalone.jsView on unpkg · L1

tests/hall_profile_world.mjsView file

38// node modules/ui-design/kit/render.js --states modules/hall-ui/public/profile.states.json \ L39: // --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621 L40: ... L169: }, L170: console, Date, Map, Set, Math, Number, String, Array, Infinity, URLSearchParams, L171: }; ... L184: // deep-equal against a literal here fails on identity alone; compare the data. L185: const plain = (v) => JSON.parse(JSON.stringify(v)); L186: ... L354: assert.ok(own.mount.innerHTML.includes('id="chart-rate"'), 'and the pace chart draws'); L355: assert.ok(own.mount.innerHTML.includes('only you see this one'), 'saying plainly that it is private'); L356: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

tests/hall_profile_world.mjsView on unpkg · L38

scripts/gds/fitness-ratchets.jsView file

Lines 19-59javascript

19// duplicate_window_count — normalized WINDOW-line blocks appearing in 2+

20// distinct files (the in-house jscpd: cross-file copy/paste)

21// require_cycle_count — strongly-connected components (size >1) in the

22// relative-require graph (the in-house madge)

23// console_call_count — console.* call sites in SERVER paths (src/ + modules/

24// minus their browser public/ trees); task 1003130 converts the core path

25// to structured logging and shrinks this baseline

26// doc_stale_links / doc_broken_anchors / doc_duplicate_prose — the

27// docs-entropy scanner's three counts, reused as a library

modules/ui-design/kit/serve.jsView file

Lines 7-47javascript

7// module may not require core and the doorway may not import the serving domain,

8// so the real code path is reached as a child process) — plus the content-hash

9// ?v= stamp, with the instance's own branding pack. Answers the public feeds from

10// fixtures/ so a page boots with real-shaped data and no database. Serves docs/

11// raw so a mock under docs/design/mocks/ renders with its relative links.

12//

13// node modules/ui-design/kit/serve.js -> http://127.0.0.1:3412/ (the public-landing module)

14// SURFACE=<dir or module key> a checkout dir ("modules/hall-ui/public") or a module

15// key ("public-landing") whose manifest declares a webSurfaces dir

scripts/gds/build-bongos.jsView file

24const path = require('node:path'); L25: const { spawnSync } = require('node:child_process'); L26: const { arg } = require('./cli-lib'); L27: L28: const REPO_ROOT = path.join(__dirname, '..', '..'); L29: const ENTRY = path.join(REPO_ROOT, 'bin', 'bongos.js'); ... L42: function bunPresent() { L43: const r = spawnSync('bun', ['--version'], { encoding: 'utf8', shell: process.platform === 'win32' }); L44: return !!r && !r.error && r.status === 0; ... L66: console.error('✖ `bun` is required to compile the standalone binary but was not found.'); L67: console.error(' Install it (https://bun.sh) — e.g. `curl -fsSL https://bun.sh/install | bash` —'); L68: console.error(' or in CI use the oven-sh/setup-bun action. Then re-run.');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/gds/build-bongos.jsView on unpkg · L24

modules/security/artifact-scan/fetch.jsView file

10L11: const dns = require('node:dns'); L12: const fsp = require('node:fs/promises'); L13: const path = require('node:path'); L14: const { spawn } = require('node:child_process'); L15: ... L19: const MAX_CAPTURE_BYTES = 1 * 1024 * 1024; L20: // git's stderr can name internal hosts and paths; only a short excerpt travels, L21: // and only in a finding's detail, never in a message a caller might echo. ... L50: if (a === 0) return 'the unspecified range'; L51: if (a === 10) return 'a private (RFC 1918) address'; L52: if (a === 172 && b >= 16 && b <= 31) return 'a private (RFC 1918) address';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

modules/security/artifact-scan/fetch.jsView on unpkg · L10

tests/grader_prompt_fencing.mjsView file

74contains invisible/control Unicode U+202E (right-to-left override) const dirty = `a${'<U+202E>'}b${'<U+202D>'}c${'<U+202A>'}d`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

tests/grader_prompt_fencing.mjsView on unpkg · L74

docker-entrypoint.shView file

•path = docker-entrypoint.sh kind = build_helper sizeBytes = 1075 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker-entrypoint.shView on unpkg

modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 86

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View on unpkg

tests/audit_middleware.mjsView file

365patternName = generic_password severity = medium line = 365

Medium

Secret Pattern

Hardcoded password in tests/audit_middleware.mjs

tests/audit_middleware.mjsView on unpkg · L365

tests/provision.mjsView file

2994patternName = generic_password severity = medium line = 2994

Medium

Secret Pattern

Hardcoded password in tests/provision.mjs

tests/provision.mjsView on unpkg · L2994

3032patternName = generic_password severity = medium line = 3032

Medium

Secret Pattern

Hardcoded password in tests/provision.mjs

tests/provision.mjsView on unpkg · L3032

tests/auto_merge_diagnosis.mjsView file

297patternName = github_pat severity = critical line = 297

Critical

Secret Pattern

GitHub personal access token in tests/auto_merge_diagnosis.mjs

tests/auto_merge_diagnosis.mjsView on unpkg · L297

tests/logger.mjsView file

62patternName = github_pat severity = critical line = 62

Critical

Secret Pattern

GitHub personal access token in tests/logger.mjs

tests/logger.mjsView on unpkg · L62

tests/secret_gate.mjsView file

21patternName = github_pat severity = critical line = 21

Critical

Secret Pattern

GitHub personal access token in tests/secret_gate.mjs

tests/secret_gate.mjsView on unpkg · L21

tests/key-status.mjsView file

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in tests/key-status.mjs

tests/key-status.mjsView on unpkg · L25

Source & flagged code

23 flagged · loading source

tests/public_mirror_export.mjsView file

103patternName = aws_access_key severity = critical line = 103

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/public_mirror_export.mjsView on unpkg · L103

103patternName = aws_access_key severity = critical line = 103

Critical

Secret Pattern

AWS access key ID in tests/public_mirror_export.mjs

tests/public_mirror_export.mjsView on unpkg · L103

bin/bongos.jsView file

19const path = require('node:path'); L20: const { spawnSync } = require('node:child_process'); L21:

High

Child Process

Package source references child process execution.

bin/bongos.jsView on unpkg · L19

Findings

6 Critical8 High10 Medium7 Low

CriticalCritical Secrettests/public_mirror_export.mjs

CriticalTrojan Source Unicodetests/grader_prompt_fencing.mjs

CriticalSecret Patterntests/public_mirror_export.mjs

CriticalSecret Patterntests/auto_merge_diagnosis.mjs

CriticalSecret Patterntests/logger.mjs

CriticalSecret Patterntests/secret_gate.mjs

HighChild Processbin/bongos.js

HighShellscripts/setup-builder.js

HighSame File Env Network Executionmodules/ui-design/kit/serve.js

HighSandbox Evasion Gated Capabilityscripts/gds/build-bongos.js

HighCloud Metadata Accessmodules/security/artifact-scan/fetch.js

Affected versions and remediation

This report applies to @bongos/core@1.20.25.

See all versions of @bongos/core for other recorded verdicts.

Review the evidence and your use of @bongos/core@1.20.25 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 01:00:20.426Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.