registry / @cairnvibe/indexer / 0.2.2
@cairnvibe/indexer@0.2.2
Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe flagged process execution is explicit CLI functionality, not an npm lifecycle hook or import side effect. The self-name appears only in a fixed user-command install list, and the package has no runtime self-dependency or lifecycle chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `cairn setup` or `cairn build`.
Impact
The selected project can be scaffolded and its source can be sent to the configured LLM provider; this is aligned with the CLI's requested operation.
Mechanism
User-invoked project scaffolding, fixed dependency installation, and LLM-backed source analysis.
AI rationale
The flagged process execution is explicit CLI functionality, not an npm lifecycle hook or import side effect. The self-name appears only in a fixed user-command install list, and the package has no runtime self-dependency or lifecycle chain.
Evidence
package.jsondist/setup.jsdist/manifest.jsdist/l3-describe.jsdist/llm.jsdist/cli.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and contains no npm install lifecycle hook.
- The runtime install is only in the explicit `cairn setup` command and uses a fixed package list.
- The child-process use in manifest generation only queries the current Git commit with fixed arguments.
Evidence against
- No install-time or import-time execution was found.
- No secret harvesting, arbitrary shell input, destructive action, or persistence was found.
- LLM calls and source transfer occur only during a user-invoked build/setup flow with configured provider credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flaggeddist/manifest.jsView file
3exports.assembleManifest = assembleManifest;
L4: const node_child_process_1 = require("node:child_process");
L5: function assembleManifest(rootDir, facts, l2, l3) {
High
66function getCommit(rootDir) {
try {
return (0, node_child_process_1.execFileSync)("git", ["rev-parse", "--short", "HEAD"], {
cwd: rootDir,
encoding: "utf8",
stdio: ["ignore", "pipe", "ignore"],
}).trim();
}
catch {
return "unknown";
}
Low
Ai Review Evidence
The child-process use in manifest generation only queries the current Git commit with fixed arguments.
dist/manifest.jsView on unpkg · L66dist/l3-describe.jsView file
8exports.describeAll = describeAll;
L9: const node_fs_1 = __importDefault(require("node:fs"));
L10: const node_path_1 = __importDefault(require("node:path"));
Findings
1 Critical2 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/setup.js
HighChild Processdist/manifest.js
HighRuntime Package Installdist/setup.js
MediumDynamic Requiredist/l3-describe.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/setup.js
LowAi Review Evidencedist/manifest.js
Affected versions and remediation
This report applies to @cairnvibe/indexer@0.2.2.
See all versions of @cairnvibe/indexer for other recorded verdicts.
- Review the evidence and your use of @cairnvibe/indexer@0.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.