registry / Credential exfiltration / @bongos/core / 1.20.47

@bongos/core@1.20.47

Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).

AI Security Review

scanned 5d ago · by lpm-firewall-ai

This is a conditional credential exposure capability, not evidence of covert default exfiltration: it requires an operator-set destination and a user-run CLI request. The saved token is still sent to that destination without an allowlist, so warn rather than mark clean.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An operator sets the API-base environment variable and runs a CLI command that makes an authenticated API call.

Impact

The configured destination could receive a saved service session token.

Mechanism

The CLI resolves the destination from the environment before the saved session base, then adds the saved token to the request and sends it to that destination.

AI rationale

Evidence

src/instance-config.jsscripts/gds/cli-lib.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest declares the CLI and runtime entrypoints; the inspected manifest has no lifecycle script.
The API base resolver prioritizes an environment override over the saved session destination and returns that override without a host allowlist.
A normal API call loads the saved session, attaches its token as a bearer credential, and sends the request to the resolved base URL.
The flagged skill-lint code reads a skill-file path and lints it; its hook reports findings without performing account actions. The metrics middleware handles HTTP request metrics.

Evidence against

The exposure requires an operator-configured API-base environment variable and a user-run CLI request; no package-selected fixed recipient was found.
The CLI checks for a mismatch between the saved session and the configured instance before making its request.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Source & flagged code

23 flagged

tests/public_mirror_export.mjsView file

103patternName = aws_access_key severity = critical line = 103

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/public_mirror_export.mjsView on unpkg · L103

103patternName = aws_access_key severity = critical line = 103

Critical

Secret Pattern

AWS access key ID in tests/public_mirror_export.mjs

tests/public_mirror_export.mjsView on unpkg · L103

bin/bongos.jsView file

19const path = require('node:path'); L20: const { spawnSync } = require('node:child_process'); L21:

High

Child Process

Package source references child process execution.

bin/bongos.jsView on unpkg · L19

18L19: const path = require('node:path'); L20: const { spawnSync } = require('node:child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bongos.jsView on unpkg · L18

scripts/setup-builder.jsView file

71// and never spread from caller-supplied opts: shell:true on Windows runs the L72: // args through cmd.exe expansion, so it's used ONLY for `npm` (a .cmd shim that L73: // can't be spawned without a shell) and ONLY with hardcoded args — never with

High

Shell

Package source references shell execution.

scripts/setup-builder.jsView on unpkg · L71

public-docs/redoc.standalone.jsView file

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Hardcoded password in public-docs/redoc.standalone.js

public-docs/redoc.standalone.jsView on unpkg · L8

1/*! For license information please see redoc.standalone.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("null")):"function"==typeof define&&define.amd?define(["null"],t):"object"==typeof exports... L3: || (${a} == "string" && ${i} && ${i} == +${i})`).assign(l,s._`+${i}`);case"integer":return void n.elseIf(s._`${a} === "boolean" || ${i} === null

Low

Eval

Package source references a known benign dynamic code generation pattern.

public-docs/redoc.standalone.jsView on unpkg · L1

tests/hall_profile_world.mjsView file

38// node modules/ui-design/kit/render.js --states modules/hall-ui/public/profile.states.json \ L39: // --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621 L40: ... L169: }, L170: console, Date, Map, Set, Math, Number, String, Array, Infinity, URLSearchParams, L171: }; ... L184: // deep-equal against a literal here fails on identity alone; compare the data. L185: const plain = (v) => JSON.parse(JSON.stringify(v)); L186: ... L354: assert.ok(own.mount.innerHTML.includes('id="chart-rate"'), 'and the pace chart draws'); L355: assert.ok(own.mount.innerHTML.includes('only you see this one'), 'saying plainly that it is private'); L356: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

tests/hall_profile_world.mjsView on unpkg · L38

scripts/gds/fitness-ratchets.jsView file

246knipSkipReason = `no knip in ${path.join(ROOT, 'node_modules')} — ` L247: + 'npx would resolve one from outside this tree and report it as an unlisted ' L248: + 'binary, scoring one higher than the same code scores in CI (task 1003987)'; ... L252: try { L253: raw = execSync('npx --no-install knip --reporter json --no-exit-code', { L254: cwd: ROOT, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/gds/fitness-ratchets.jsView on unpkg · L246

39const crypto = require('crypto'); L40: const { execFileSync, execSync } = require('child_process'); L41: L42: const ROOT = path.resolve(__dirname, '..', '..'); L43: const BASELINE_PATH = path.join(ROOT, 'config', 'fitness-baselines.json'); ... L89: for (let i = 0; i + window <= lines.length; i++) { L90: const h = crypto.createHash('sha1').update(lines.slice(i, i + window).join('\n')).digest('base64'); L91: let set = filesByHash.get(h); ... L208: // main checkout (knip local) -> 221 L209: // worktree (knip ambient) -> 222, the extra being `binaries: package.json knip` L210: // Diffed by name, the exports lists were IDENTICAL (221 both sides). knip was ... L256: } catch (e) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/gds/fitness-ratchets.jsView on unpkg · L39

modules/ui-design/kit/serve.jsView file

27// Exit 2 on a surface that does not resolve. Prints ONE line when listening L28: // ("stub on http://…") — render.js and probe.js wait for it. L29: const http = require('node:http'); ... L33: const crypto = require('node:crypto'); L34: const { spawnSync } = require('node:child_process'); L35: const lib = require('./lib.js'); L36: L37: const ROOT = process.env.STUB_REPO ? path.resolve(process.env.STUB_REPO) : lib.REPO_ROOT; L38: const SURFACE = process.env.SURFACE || 'public-landing';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

modules/ui-design/kit/serve.jsView on unpkg · L27

scripts/gds/build-bongos.jsView file

24const path = require('node:path'); L25: const { spawnSync } = require('node:child_process'); L26: const { arg } = require('./cli-lib'); L27: L28: const REPO_ROOT = path.join(__dirname, '..', '..'); L29: const ENTRY = path.join(REPO_ROOT, 'bin', 'bongos.js'); ... L42: function bunPresent() { L43: const r = spawnSync('bun', ['--version'], { encoding: 'utf8', shell: process.platform === 'win32' }); L44: return !!r && !r.error && r.status === 0; ... L66: console.error('✖ `bun` is required to compile the standalone binary but was not found.'); L67: console.error(' Install it (https://bun.sh) — e.g. `curl -fsSL https://bun.sh/install | bash` —'); L68: console.error(' or in CI use the oven-sh/setup-bun action. Then re-run.');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/gds/build-bongos.jsView on unpkg · L24

modules/security/artifact-scan/fetch.jsView file

10L11: const dns = require('node:dns'); L12: const fsp = require('node:fs/promises'); L13: const path = require('node:path'); L14: const { spawn } = require('node:child_process'); L15: ... L19: const MAX_CAPTURE_BYTES = 1 * 1024 * 1024; L20: // git's stderr can name internal hosts and paths; only a short excerpt travels, L21: // and only in a finding's detail, never in a message a caller might echo. ... L50: if (a === 0) return 'the unspecified range'; L51: if (a === 10) return 'a private (RFC 1918) address'; L52: if (a === 172 && b >= 16 && b <= 31) return 'a private (RFC 1918) address';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

modules/security/artifact-scan/fetch.jsView on unpkg · L10

tests/grader_prompt_fencing.mjsView file

74contains invisible/control Unicode U+202E (right-to-left override) const dirty = `a${'<U+202E>'}b${'<U+202D>'}c${'<U+202A>'}d`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

tests/grader_prompt_fencing.mjsView on unpkg · L74

docker-entrypoint.shView file

•path = docker-entrypoint.sh kind = build_helper sizeBytes = 1075 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker-entrypoint.shView on unpkg

modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 84

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View on unpkg

tests/audit_middleware.mjsView file

365patternName = generic_password severity = medium line = 365

Medium

Secret Pattern

Hardcoded password in tests/audit_middleware.mjs

tests/audit_middleware.mjsView on unpkg · L365

tests/provision.mjsView file

3053patternName = generic_password severity = medium line = 3053

Medium

Secret Pattern

Hardcoded password in tests/provision.mjs

tests/provision.mjsView on unpkg · L3053

3091patternName = generic_password severity = medium line = 3091

Medium

Secret Pattern

Hardcoded password in tests/provision.mjs

tests/provision.mjsView on unpkg · L3091

tests/auto_merge_diagnosis.mjsView file

297patternName = github_pat severity = critical line = 297

Critical

Secret Pattern

GitHub personal access token in tests/auto_merge_diagnosis.mjs

tests/auto_merge_diagnosis.mjsView on unpkg · L297

tests/logger.mjsView file

62patternName = github_pat severity = critical line = 62

Critical

Secret Pattern

GitHub personal access token in tests/logger.mjs

tests/logger.mjsView on unpkg · L62

tests/secret_gate.mjsView file

21patternName = github_pat severity = critical line = 21

Critical

Secret Pattern

GitHub personal access token in tests/secret_gate.mjs

tests/secret_gate.mjsView on unpkg · L21

tests/key-status.mjsView file

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in tests/key-status.mjs

tests/key-status.mjsView on unpkg · L25

Source & flagged code

23 flagged · loading source

tests/public_mirror_export.mjsView file

103patternName = aws_access_key severity = critical line = 103

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/public_mirror_export.mjsView on unpkg · L103

103patternName = aws_access_key severity = critical line = 103

Critical

Secret Pattern

AWS access key ID in tests/public_mirror_export.mjs

tests/public_mirror_export.mjsView on unpkg · L103

bin/bongos.jsView file

19const path = require('node:path'); L20: const { spawnSync } = require('node:child_process'); L21:

High

Child Process

Package source references child process execution.

bin/bongos.jsView on unpkg · L19

Findings

6 Critical8 High10 Medium7 Low

CriticalCritical Secrettests/public_mirror_export.mjs

CriticalTrojan Source Unicodetests/grader_prompt_fencing.mjs

CriticalSecret Patterntests/public_mirror_export.mjs

CriticalSecret Patterntests/auto_merge_diagnosis.mjs

CriticalSecret Patterntests/logger.mjs

CriticalSecret Patterntests/secret_gate.mjs

HighChild Processbin/bongos.js

HighShellscripts/setup-builder.js

HighSame File Env Network Executionmodules/ui-design/kit/serve.js

HighSandbox Evasion Gated Capabilityscripts/gds/build-bongos.js

HighCloud Metadata Accessmodules/security/artifact-scan/fetch.js

Affected versions and remediation

This report applies to @bongos/core@1.20.47.

See all versions of @bongos/core for other recorded verdicts.

Review the evidence and your use of @bongos/core@1.20.47 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 01:02:51.422Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.