registry / @cairnvibe/indexer / 0.2.1
@cairnvibe/indexer@0.2.1
Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe self-install and project edits are transparent consequences of an explicit setup command, not an npm lifecycle action. Source inspection found no concrete malicious chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs cairn setup or cairn build.
Impact
The setup command can modify the selected project, but no automatic install-time execution or covert exfiltration was found.
Mechanism
User-invoked project scaffolding and LLM-assisted analysis.
AI rationale
The self-install and project edits are transparent consequences of an explicit setup command, not an npm lifecycle action. Source inspection found no concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The explicit cairn setup command can install a newer @cairnvibe/indexer release into the target project.
- That user-invoked setup can write a .env file and add a prebuild command.
- Child-process use also includes a fixed git command to read the current commit.
- The package scripts define build and typecheck only, with no install lifecycle hook.
- The manifest reads the current Git commit using a fixed local git command.
Evidence against
- The manifest has no preinstall, install, or postinstall lifecycle hook.
- The setup path is reached only through the explicit cairn setup CLI command.
- No credential harvesting, hidden network endpoint, obfuscated payload, or agent-control configuration mutation was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flaggeddist/manifest.jsView file
3exports.assembleManifest = assembleManifest;
L4: const node_child_process_1 = require("node:child_process");
L5: function assembleManifest(rootDir, facts, l2, l3) {
High
68return (0, node_child_process_1.execFileSync)("git", ["rev-parse", "--short", "HEAD"], {
cwd: rootDir,
encoding: "utf8",
stdio: ["ignore", "pipe", "ignore"],
}).trim();
Low
Ai Review Evidence
The manifest reads the current Git commit using a fixed local git command.
dist/manifest.jsView on unpkg · L68dist/l3-describe.jsView file
8exports.describeAll = describeAll;
L9: const node_fs_1 = __importDefault(require("node:fs"));
L10: const node_path_1 = __importDefault(require("node:path"));
Medium
Findings
1 Critical2 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/setup.js
HighChild Processdist/manifest.js
HighRuntime Package Installdist/setup.js
MediumDynamic Requiredist/l3-describe.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowAi Review Evidencedist/setup.js
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/manifest.js
Affected versions and remediation
This report applies to @cairnvibe/indexer@0.2.1.
See all versions of @cairnvibe/indexer for other recorded verdicts.
- Review the evidence and your use of @cairnvibe/indexer@0.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.