@bongos/core@1.20.56

⚠ Under review

Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The inspected manifest and source do not establish malicious behavior, and the scanner's account-action hint resolves to a skill-file lint hook. The package has a broad runtime surface that this inspection did not resolve, so the evidence is insufficient for a clean verdict.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Unresolved; no malicious trigger was established in the inspected paths.

Impact

No confirmed harmful effect; broader runtime behavior could not be resolved from this inspection.

Mechanism

Inspected code includes a user-invoked CLI, project-local Claude materialization, and a skill-file lint hook; those facts do not establish an attack.

AI rationale

Decision evidence

public snapshot

AI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest points to a server entrypoint and a CLI; it declares no lifecycle hook in the inspected package metadata.
The skill-lint hook runs only when explicitly invoked with `--hook`, checks whether a SKILL.md was touched, and returns without breaking the edit.
The inspected metrics middleware records request counts and durations; the cited runtime-operation hint is not evidence of an attack.

Evidence against

The inspected CLI dispatches user-selected commands, and init materializes project-local Claude files.
The source reviewed so far does not establish a concrete credential transfer, unauthorized account action, or install-time control-surface change.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetry

Source & flagged code

23 flagged

tests/public_mirror_export.mjsView file

Lines 83-123javascript

83 assert.equal(isBinary(Buffer.from('plain text file\nwith lines')), false);

84 assert.equal(isBinary(Buffer.from('')), false);

85});

87// ── redactBlob ───────────────────────────────────────────────────────────────────────

88t('redactBlob redacts a text blob and reports zero leaks', () => {

89 const r = redactBlob({ buf: Buffer.from('serve https://widgetco.com to zoltan at 8.8.8.8'), rules, sensitiveLiterals, envSecrets: [] });

90 const text = r.buf.toString('utf8');

91 assert.ok(!/widgetco|zoltan|8\.8\.8\.8/i.test(text), text);

92 assert.deepEqual(r.leaks, []);

93 assert.equal(r.secret, false);

94});

95t('redactBlob keeps a binary blob verbatim but still leak-scans it', () => {

96 const bin = Buffer.concat([Buffer.from('PNG\x00'), Buffer.from('widgetco'), Buffer.from('\x00')]);

97 const r = redactBlob({ buf: bin, rules, sensitiveLiterals, envSecrets: [] });

98 assert.ok(r.buf.equals(bin), 'binary must be byte-identical (not corrupted by text redaction)');

99 assert.ok(r.leaks.length > 0, 'a literal embedded in a binary must still trip the gate');

100});

101t('redactBlob SCRUBS a secret shape from a text blob (handled, not leaked)', () => {

102 const r = redactBlob({ buf: Buffer.from('key AKIA' + 'ABCDEFGHIJKLMNOP here'), rules, sensitiveLiterals, envSecrets: [] });

103 assert.ok(!r.buf.toString('utf8').includes('AKIAABCDEFGHIJKLMNOP'), 'the secret must be scrubbed from the published text');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/public_mirror_export.mjsView on unpkg · L103

104 assert.equal(r.secret, false, 'a scrubbed text secret is handled, so it is not a residual leak');

105});

106// Regression (task 1003873). The secret verdict audits THIS call's own scrub, so it has to

107// share the scrub's knownDocNames allowlist. When it did not, the audit re-redacted the ADR

108// filename the scrub had just spared, read the difference as a leak, and failed the packager

109// closed on every doc in the tree — the publish lane stayed red for seven core releases.

110t('redactBlob reports no secret for an allowlisted doc filename (the gate agrees with its own scrub)', () => {

111 const name = '0281-differential-audit-allowlist-symmetry.md';

112 const knownDocNames = new Set([name]);

113 const r = redactBlob({ buf: Buffer.from(`see [ADR 0281](docs/adr/${name}) for why`), rules, sensitiveLiterals, envSecrets: [], knownDocNames });

114 assert.ok(r.buf.toString('utf8').includes(name), 'the allowlisted filename must survive the scrub');

115 assert.equal(r.secret, false, 'and must not then be reported as a residual secret');

116 assert.deepEqual(r.leaks, []);

117});

118t('redactBlob FAILS CLOSED on a secret inside a BINARY blob (cannot safely rewrite it)', () => {

119 const bin = Buffer.concat([Buffer.from('BIN\x00'), Buffer.from('AKIA' + 'ABCDEFGHIJKLMNOP')]);

120 const r = redactBlob({ buf: bin, rules, sensitiveLiterals, envSecrets: [] });

121 assert.ok(r.buf.equals(bin), 'binary kept verbatim');

122 assert.equal(r.secret, true, 'a secret in a binary must trip the gate (the export then publishes nothing)');

123});

103patternName = aws_access_key severity = critical line = 103

Critical

Secret Pattern

AWS access key ID in tests/public_mirror_export.mjs

tests/public_mirror_export.mjsView on unpkg · L103

bin/bongos.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// bin/bongos.js — the Cloud Bongos CLI dispatcher.

3//

4// GDS-V4 · V4.R79 · task 1246 (Phase 1 of the `bongos` toolkit; epic 1245).

5//

6// A single `bongos <verb>` front door over the existing scripts/gds/* scripts —

7// the same actions the /builder-* slash-commands run inside Claude Code, now

8// usable from any terminal, VS Code, a Chromebook, or CI. This is deliberately a

9// THIN dispatcher: it spawns the target script with `process.execPath` (the one

10// guaranteed cross-platform runtime — no bash, #686) and forwards argv + exit

scripts/setup-builder.jsView file

Lines 51-91javascript

51 process.exit(0);

52 } else {

53 console.error(`Unknown argument: ${a}`);

54 console.error('Run with --help for usage.');

55 process.exit

public-docs/redoc.standalone.jsView file

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Hardcoded password in public-docs/redoc.standalone.js

public-docs/redoc.standalone.jsView on unpkg · L8

1/*! For license information please see redoc.standalone.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("null")):"function"==typeof define&&define.amd?define(["null"],t):"object"==typeof exports... L3: || (${a} == "string" && ${i} && ${i} == +${i})`).assign(l,s._`+${i}`);case"integer":return void n.elseIf(s._`${a} === "boolean" || ${i} === null

Low

Eval

Package source references a known benign dynamic code generation pattern.

public-docs/redoc.standalone.jsView on unpkg · L1

tests/hall_profile_world.mjsView file

Lines 18-58javascript

18// ledgers are one key over, so the first screen is a screen.

19// * THE CHARTS ARE ARITHMETIC FIRST. cumulativeByDay folds two ships on one

20// day into one point and accumulates, over whichever timestamp the caller

21// names; craftMix folds the tail past seven into "other" rather than

22// minting an eighth hue; weeklyBuckets is a time axis (every week present,

23// empty or not).

24// * DRACHMAE COME FROM THE LEDGER (task 1003491). The earned line is the

25// credits ledger — /me/credits on your own profile, /builders/:id/credits

26// on another's — `delta` cumulated by `recorded_at`, so it ends at the

scripts/gds/fitness-ratchets.jsView file

Lines 19-59javascript

19// duplicate_window_count — normalized WINDOW-line blocks appearing in 2+

20// distinct files (the in-house jscpd: cross-file copy/paste)

21// require_cycle_count — strongly-connected components (size >1) in the

22// relative-require graph (the in-house madge)

23// console_call_count — console.* call sites in SERVER paths (src/ + modules/

24// minus their browser public/ trees); task 1003130 converts the core path

25// to structured logging and shrinks this baseline

26// doc_stale_links / doc_broken_anchors / doc_duplicate_prose — the

27// docs-entropy scanner's three counts, reused as a library

modules/ui-design/kit/serve.jsView file

Lines 7-47javascript

7// module may not require core and the doorway may not import the serving domain,

8// so the real code path is reached as a child process) — plus the content-hash

9// ?v= stamp, with the instance's own branding pack. Answers the public feeds from

10// fixtures/ so a page boots with real-shaped data and no database. Serves docs/

11// raw so a mock under docs/design/mocks/ renders with its relative links.

12//

13// node modules/ui-design/kit/serve.js -> http://127.0.0.1:3412/ (the public-landing module)

14// SURFACE=<dir or module key> a checkout dir ("modules/hall-ui/public") or a module

15// key ("public-landing") whose manifest declares a webSurfaces dir

scripts/gds/build-bongos.jsView file

24const path = require('node:path'); L25: const { spawnSync } = require('node:child_process'); L26: const { arg } = require('./cli-lib'); L27: L28: const REPO_ROOT = path.join(__dirname, '..', '..'); L29: const ENTRY = path.join(REPO_ROOT, 'bin', 'bongos.js'); ... L42: function bunPresent() { L43: const r = spawnSync('bun', ['--version'], { encoding: 'utf8', shell: process.platform === 'win32' }); L44: return !!r && !r.error && r.status === 0; ... L66: console.error('✖ `bun` is required to compile the standalone binary but was not found.'); L67: console.error(' Install it (https://bun.sh) — e.g. `curl -fsSL https://bun.sh/install | bash` —'); L68: console.error(' or in CI use the oven-sh/setup-bun action. Then re-run.');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/gds/build-bongos.jsView on unpkg · L24

modules/security/artifact-scan/fetch.jsView file

10L11: const dns = require('node:dns'); L12: const fsp = require('node:fs/promises'); L13: const path = require('node:path'); L14: const { spawn } = require('node:child_process'); L15: ... L19: const MAX_CAPTURE_BYTES = 1 * 1024 * 1024; L20: // git's stderr can name internal hosts and paths; only a short excerpt travels, L21: // and only in a finding's detail, never in a message a caller might echo. ... L50: if (a === 0) return 'the unspecified range'; L51: if (a === 10) return 'a private (RFC 1918) address'; L52: if (a === 172 && b >= 16 && b <= 31) return 'a private (RFC 1918) address';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

modules/security/artifact-scan/fetch.jsView on unpkg · L10

tests/grader_prompt_fencing.mjsView file

74contains invisible/control Unicode U+202E (right-to-left override) const dirty = `a${'<U+202E>'}b${'<U+202D>'}c${'<U+202A>'}d`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

tests/grader_prompt_fencing.mjsView on unpkg · L74

docker-entrypoint.shView file

•path = docker-entrypoint.sh kind = build_helper sizeBytes = 1075 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker-entrypoint.shView on unpkg

modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 83

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View on unpkg

tests/audit_middleware.mjsView file

365patternName = generic_password severity = medium line = 365

Medium

Secret Pattern

Hardcoded password in tests/audit_middleware.mjs

tests/audit_middleware.mjsView on unpkg · L365

tests/provision.mjsView file

3053patternName = generic_password severity = medium line = 3053

Medium

Secret Pattern

Hardcoded password in tests/provision.mjs

tests/provision.mjsView on unpkg · L3053

3091patternName = generic_password severity = medium line = 3091

Medium

Secret Pattern

Hardcoded password in tests/provision.mjs

tests/provision.mjsView on unpkg · L3091

tests/auto_merge_diagnosis.mjsView file

297patternName = github_pat severity = critical line = 297

Critical

Secret Pattern

GitHub personal access token in tests/auto_merge_diagnosis.mjs

tests/auto_merge_diagnosis.mjsView on unpkg · L297

tests/logger.mjsView file

62patternName = github_pat severity = critical line = 62

Critical

Secret Pattern

GitHub personal access token in tests/logger.mjs

tests/logger.mjsView on unpkg · L62

tests/secret_gate.mjsView file

21patternName = github_pat severity = critical line = 21

Critical

Secret Pattern

GitHub personal access token in tests/secret_gate.mjs

tests/secret_gate.mjsView on unpkg · L21

tests/key-status.mjsView file

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in tests/key-status.mjs

tests/key-status.mjsView on unpkg · L25

Source & flagged code

23 flagged · loading source

tests/public_mirror_export.mjsView file

103patternName = aws_access_key severity = critical line = 103

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/public_mirror_export.mjsView on unpkg · L103

103patternName = aws_access_key severity = critical line = 103

Critical

Secret Pattern

AWS access key ID in tests/public_mirror_export.mjs

tests/public_mirror_export.mjsView on unpkg · L103

bin/bongos.jsView file

19const path = require('node:path'); L20: const { spawnSync } = require('node:child_process'); L21:

High

Child Process

Package source references child process execution.

bin/bongos.jsView on unpkg · L19

Findings

6 Critical8 High10 Medium7 Low

CriticalCritical Secrettests/public_mirror_export.mjs

CriticalTrojan Source Unicodetests/grader_prompt_fencing.mjs

CriticalSecret Patterntests/public_mirror_export.mjs

CriticalSecret Patterntests/auto_merge_diagnosis.mjs

CriticalSecret Patterntests/logger.mjs

CriticalSecret Patterntests/secret_gate.mjs

HighChild Processbin/bongos.js

HighShellscripts/setup-builder.js

HighSame File Env Network Executionmodules/ui-design/kit/serve.js

HighSandbox Evasion Gated Capabilityscripts/gds/build-bongos.js

HighCloud Metadata Accessmodules/security/artifact-scan/fetch.js

Affected versions and remediation

This report applies to @bongos/core@1.20.56.

See all versions of @bongos/core for other recorded verdicts.

Review the evidence and your use of @bongos/core@1.20.56 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 01:03:58.509Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.