@bongos/core@1.20.7
Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe source sends transcript turns to the Claude CLI under a consent flow whose empty response means yes, despite telling users raw transcripts remain local. This supports a warning for data exposure, but the feature is user-enabled and the source does not establish malicious intent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs setup and accepts the onboarding-log prompt; later, the analysis script runs while the saved consent window is active.
Impact
Transcript content can leave the machine for model processing without the prompt disclosing that transfer. The report sent to the instance API can also contain session identifiers and excerpts of friction evidence.
Mechanism
Setup treats an empty answer as consent. The session-start spooler saves transcripts locally, then the analyzer builds a prompt from their turns and pipes it to the Claude CLI before posting analysis results.
AI rationale
The source sends transcript turns to the Claude CLI under a consent flow whose empty response means yes, despite telling users raw transcripts remain local. This supports a warning for data exposure, but the feature is user-enabled and the source does not establish malicious intent.
Evidence
scripts/gds/setup.jsscripts/gds/onboarding-config.jsscripts/gds/onboarding-ship.jsscripts/gds/onboarding-analyze.jsmodules/onboarding/onboarding.jsmodules/grading/grader-subagent.jsscripts/gds/cli-lib.js
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The setup prompt asks permission to analyze onboarding logs, but an empty response is treated as yes and saved as consent.
- The session-start spooler checks the saved consent window, then reads complete transcript files and stores compressed copies locally.
- The analyzer builds a model prompt from transcript turns and sends it to the Claude CLI through standard input.
- After analysis, the code posts a report containing session details and friction evidence to the configured instance API; the source says raw transcripts are not uploaded there.
- The manifest contains no install lifecycle scripts, and the flagged package-manager command uses a no-install option.
- The account-action scanner hit is a skill-lint hook that checks a file and prints diagnostics; the inspected integration locations are CLI and project-configuration code.
Evidence against
- This is an onboarding-analysis feature, and setup provides a way to decline it.
- The code gates automatic processing on a saved consent record and time window; the transcript spool is local.
- The source does not establish malicious intent or an install-time data transfer.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
CopyleftLicense
Source & flagged code
23 flagged · loading sourcetests/public_mirror_export.mjsView file
103patternName = aws_access_key
severity = critical
line = 103
Critical
Critical Secret
Package contains a critical-looking secret pattern.
tests/public_mirror_export.mjsView on unpkg · L103103patternName = aws_access_key
severity = critical
line = 103
Critical
Secret Pattern
AWS access key ID in tests/public_mirror_export.mjs
tests/public_mirror_export.mjsView on unpkg · L103bin/bongos.jsView file
19const path = require('node:path');
L20: const { spawnSync } = require('node:child_process');
L21:
High
18L19: const path = require('node:path');
L20: const { spawnSync } = require('node:child_process');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/bongos.jsView on unpkg · L18scripts/setup-builder.jsView file
71// and never spread from caller-supplied opts: shell:true on Windows runs the
L72: // args through cmd.exe expansion, so it's used ONLY for `npm` (a .cmd shim that
L73: // can't be spawned without a shell) and ONLY with hardcoded args — never with
High
public-docs/redoc.standalone.jsView file
8patternName = generic_password
severity = medium
line = 8
Medium
Secret Pattern
Hardcoded password in public-docs/redoc.standalone.js
public-docs/redoc.standalone.jsView on unpkg · L81/*! For license information please see redoc.standalone.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("null")):"function"==typeof define&&define.amd?define(["null"],t):"object"==typeof exports...
L3: || (${a} == "string" && ${i} && ${i} == +${i})`).assign(l,s._`+${i}`);case"integer":return void n.elseIf(s._`${a} === "boolean" || ${i} === null
Low
Eval
Package source references a known benign dynamic code generation pattern.
public-docs/redoc.standalone.jsView on unpkg · L1tests/hall_profile_world.mjsView file
38// node modules/ui-design/kit/render.js --states modules/hall-ui/public/profile.states.json \
L39: // --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621
L40:
...
L169: },
L170: console, Date, Map, Set, Math, Number, String, Array, Infinity, URLSearchParams,
L171: };
...
L184: // deep-equal against a literal here fails on identity alone; compare the data.
L185: const plain = (v) => JSON.parse(JSON.stringify(v));
L186:
...
L354: assert.ok(own.mount.innerHTML.includes('id="chart-rate"'), 'and the pace chart draws');
L355: assert.ok(own.mount.innerHTML.includes('only you see this one'), 'saying plainly that it is private');
L356: });
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
tests/hall_profile_world.mjsView on unpkg · L38scripts/gds/fitness-ratchets.jsView file
246knipSkipReason = `no knip in ${path.join(ROOT, 'node_modules')} — `
L247: + 'npx would resolve one from outside this tree and report it as an unlisted '
L248: + 'binary, scoring one higher than the same code scores in CI (task 1003987)';
...
L252: try {
L253: raw = execSync('npx --no-install knip --reporter json --no-exit-code', {
L254: cwd: ROOT, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/gds/fitness-ratchets.jsView on unpkg · L24639const crypto = require('crypto');
L40: const { execFileSync, execSync } = require('child_process');
L41:
L42: const ROOT = path.resolve(__dirname, '..', '..');
L43: const BASELINE_PATH = path.join(ROOT, 'config', 'fitness-baselines.json');
...
L89: for (let i = 0; i + window <= lines.length; i++) {
L90: const h = crypto.createHash('sha1').update(lines.slice(i, i + window).join('\n')).digest('base64');
L91: let set = filesByHash.get(h);
...
L208: // main checkout (knip local) -> 221
L209: // worktree (knip ambient) -> 222, the extra being `binaries: package.json knip`
L210: // Diffed by name, the exports lists were IDENTICAL (221 both sides). knip was
...
L256: } catch (e) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
scripts/gds/fitness-ratchets.jsView on unpkg · L39modules/ui-design/kit/serve.jsView file
27// Exit 2 on a surface that does not resolve. Prints ONE line when listening
L28: // ("stub on http://…") — render.js and probe.js wait for it.
L29: const http = require('node:http');
...
L33: const crypto = require('node:crypto');
L34: const { spawnSync } = require('node:child_process');
L35: const lib = require('./lib.js');
L36:
L37: const ROOT = process.env.STUB_REPO ? path.resolve(process.env.STUB_REPO) : lib.REPO_ROOT;
L38: const SURFACE = process.env.SURFACE || 'public-landing';
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
modules/ui-design/kit/serve.jsView on unpkg · L27scripts/gds/build-bongos.jsView file
24const path = require('node:path');
L25: const { spawnSync } = require('node:child_process');
L26: const { arg } = require('./cli-lib');
L27:
L28: const REPO_ROOT = path.join(__dirname, '..', '..');
L29: const ENTRY = path.join(REPO_ROOT, 'bin', 'bongos.js');
...
L42: function bunPresent() {
L43: const r = spawnSync('bun', ['--version'], { encoding: 'utf8', shell: process.platform === 'win32' });
L44: return !!r && !r.error && r.status === 0;
...
L66: console.error('✖ `bun` is required to compile the standalone binary but was not found.');
L67: console.error(' Install it (https://bun.sh) — e.g. `curl -fsSL https://bun.sh/install | bash` —');
L68: console.error(' or in CI use the oven-sh/setup-bun action. Then re-run.');
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/gds/build-bongos.jsView on unpkg · L24modules/security/artifact-scan/fetch.jsView file
10L11: const dns = require('node:dns');
L12: const fsp = require('node:fs/promises');
L13: const path = require('node:path');
L14: const { spawn } = require('node:child_process');
L15:
...
L19: const MAX_CAPTURE_BYTES = 1 * 1024 * 1024;
L20: // git's stderr can name internal hosts and paths; only a short excerpt travels,
L21: // and only in a finding's detail, never in a message a caller might echo.
...
L50: if (a === 0) return 'the unspecified range';
L51: if (a === 10) return 'a private (RFC 1918) address';
L52: if (a === 172 && b >= 16 && b <= 31) return 'a private (RFC 1918) address';
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
modules/security/artifact-scan/fetch.jsView on unpkg · L10tests/grader_prompt_fencing.mjsView file
74contains invisible/control Unicode U+202E (right-to-left override)
const dirty = `a${'<U+202E>'}b${'<U+202D>'}c${'<U+202A>'}d`;
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
tests/grader_prompt_fencing.mjsView on unpkg · L74docker-entrypoint.shView file
•path = docker-entrypoint.sh
kind = build_helper
sizeBytes = 1075
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
docker-entrypoint.shView on unpkgmodules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 86
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
modules/autonomy/pollers/routine-timers.js#virtual:normalized:round1View on unpkgtests/audit_middleware.mjsView file
365patternName = generic_password
severity = medium
line = 365
Medium
Secret Pattern
Hardcoded password in tests/audit_middleware.mjs
tests/audit_middleware.mjsView on unpkg · L365tests/provision.mjsView file
3081patternName = generic_password
severity = medium
line = 3081
Medium
3119patternName = generic_password
severity = medium
line = 3119
Medium
tests/auto_merge_diagnosis.mjsView file
297patternName = github_pat
severity = critical
line = 297
Critical
Secret Pattern
GitHub personal access token in tests/auto_merge_diagnosis.mjs
tests/auto_merge_diagnosis.mjsView on unpkg · L297tests/logger.mjsView file
62patternName = github_pat
severity = critical
line = 62
Critical
tests/secret_gate.mjsView file
21patternName = github_pat
severity = critical
line = 21
Critical
Secret Pattern
GitHub personal access token in tests/secret_gate.mjs
tests/secret_gate.mjsView on unpkg · L21tests/key-status.mjsView file
25patternName = google_api_key
severity = high
line = 25
High
Findings
6 Critical8 High10 Medium7 Low
CriticalCritical Secrettests/public_mirror_export.mjs
CriticalTrojan Source Unicodetests/grader_prompt_fencing.mjs
CriticalSecret Patterntests/public_mirror_export.mjs
CriticalSecret Patterntests/auto_merge_diagnosis.mjs
CriticalSecret Patterntests/logger.mjs
CriticalSecret Patterntests/secret_gate.mjs
HighChild Processbin/bongos.js
HighShellscripts/setup-builder.js
HighSame File Env Network Executionmodules/ui-design/kit/serve.js
HighSandbox Evasion Gated Capabilityscripts/gds/build-bongos.js
HighCloud Metadata Accessmodules/security/artifact-scan/fetch.js
HighRuntime Package Installscripts/gds/fitness-ratchets.js
HighSemantic Analysis Limitedmodules/autonomy/pollers/routine-timers.js#virtual:normalized:round1
HighSecret Patterntests/key-status.mjs
MediumDynamic Requirebin/bongos.js
MediumUnsafe Vm Contexttests/hall_profile_world.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdocker-entrypoint.sh
MediumStructural Risk Force Deep Review
MediumSecret Patternpublic-docs/redoc.standalone.js
MediumSecret Patterntests/audit_middleware.mjs
MediumSecret Patterntests/provision.mjs
MediumSecret Patterntests/provision.mjs
LowEvalpublic-docs/redoc.standalone.js
LowWeak Cryptoscripts/gds/fitness-ratchets.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @bongos/core@1.20.7.
See all versions of @bongos/core for other recorded verdicts.
- Review the evidence and your use of @bongos/core@1.20.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.