registry / @cairnvibe/indexer / 0.3.0
@cairnvibe/indexer@0.3.0
Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the package's setup actions are triggered by an explicit CLI command. Its package installation, optional provider-key handling, and project edits align with its stated analyzer and installer purpose.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the `cairn setup` CLI command.
Impact
Expected project onboarding changes; no source evidence showed automatic credential collection or unrelated data transfer.
Mechanism
Setup installs the named Cairn dependencies, prompts for optional provider keys, writes supplied values into the target project's .env, and can build its UI manifest.
AI rationale
The manifest has no install lifecycle hook, and the package's setup actions are triggered by an explicit CLI command. Its package installation, optional provider-key handling, and project edits align with its stated analyzer and installer purpose.
Evidence
target project's .envtarget project's package.jsontarget project setup and manifest files
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and a library entry point; its scripts contain build and typecheck, with no install lifecycle hook.
- The CLI calls setup only when the user selects the `setup` command; importing the library entry point only exposes functions.
- Setup runs npm install for the named Cairn packages as part of its explicit onboarding flow.
- Setup asks whether to configure an LLM provider, accepts a key from the user, and writes the provided key to the target project's .env.
- The initial manifest build runs only when a provider and key were supplied; this matches the package's analyzer and installer purpose.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/remove.jsView file
15const node_path_1 = __importDefault(require("node:path"));
L16: const node_child_process_1 = require("node:child_process");
L17: const install_manifest_1 = require("./install-manifest");
High
13exports.runRemove = runRemove;
L14: const node_fs_1 = __importDefault(require("node:fs"));
L15: const node_path_1 = __importDefault(require("node:path"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/remove.jsView on unpkg · L13dist/setup.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cairnvibe/indexer@0.2.6
matchedIdentity = npm:QGNhaXJudmliZS9pbmRleGVy:0.2.6
similarity = 0.524
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Findings
1 Critical2 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/setup.js
HighChild Processdist/remove.js
HighRuntime Package Installdist/setup.js
MediumDynamic Requiredist/remove.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @cairnvibe/indexer@0.3.0.
See all versions of @cairnvibe/indexer for other recorded verdicts.
- Review the evidence and your use of @cairnvibe/indexer@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.