registry / @cairnvibe/indexer / 0.4.2
@cairnvibe/indexer@0.4.2
Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the flagged npm install runs only in the interactive `cairn setup` command. That flow installs the Cairn packages and asks the user before collecting provider credentials, which it stores in the target project’s `.env` file.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No automatic attack trigger identified; setup and removal run from their explicit CLI commands.
Impact
No malicious or unrequested impact identified.
Mechanism
The flagged package installation occurs in the interactive setup flow, which asks before collecting provider credentials and stores supplied keys in the target project’s `.env` file.
AI rationale
The package has no install lifecycle hook, and the flagged npm install runs only in the interactive `cairn setup` command. That flow installs the Cairn packages and asks the user before collecting provider credentials, which it stores in the target project’s `.env` file.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes its CLI as `cairn` and declares only build and typecheck npm scripts; no install lifecycle script is present.
- The CLI runs setup or removal only when the corresponding command is selected.
- Setup installs the named Cairn packages into the target project.
- Setup prompts the user to choose an LLM provider and enter its key, then writes the supplied key to the project’s `.env` file.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/remove.jsView file
19const node_path_1 = __importDefault(require("node:path"));
L20: const node_child_process_1 = require("node:child_process");
L21: const install_manifest_1 = require("./install-manifest");
High
17exports.runRemove = runRemove;
L18: const node_fs_1 = __importDefault(require("node:fs"));
L19: const node_path_1 = __importDefault(require("node:path"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/remove.jsView on unpkg · L17dist/clack.jsView file
30// situation (used by ts-node, Jest, and others bridging CJS callers to
L31: // ESM-only packages): constructing the import call via `new Function(...)`
L32: // hides it from TypeScript's compiler entirely, so what actually runs at
Low
Eval
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/setup.js
HighChild Processdist/remove.js
HighRuntime Package Installdist/setup.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumDynamic Requiredist/remove.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/clack.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cairnvibe/indexer@0.4.2.
See all versions of @cairnvibe/indexer for other recorded verdicts.
- Review the evidence and your use of @cairnvibe/indexer@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.