registry / @cairnvibe/indexer / 0.5.0
@cairnvibe/indexer@0.5.0
Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no install hook, and its library entry point only exports functionality. The flagged installation and project-file changes occur through the user-invoked setup workflow; review found no unrelated collection, transmission, or concealed execution.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the relevant Cairn CLI command; setup is not run automatically on install or import.
Impact
No malicious behavior or unauthorized data flow was identified.
Mechanism
Setup scaffolds Cairn files, optionally installs declared dependencies, and saves user-entered provider configuration locally. It may add a documentation pointer to AGENTS.md when that file is absent.
AI rationale
The package has no install hook, and its library entry point only exports functionality. The flagged installation and project-file changes occur through the user-invoked setup workflow; review found no unrelated collection, transmission, or concealed execution.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest defines only build and typecheck scripts; it has no install lifecycle hook.
- The CLI dispatches setup, remove, and update in response to named commands; the library entry point only exports functions.
- Setup installs the declared project dependencies as part of the explicit setup command.
- Setup asks whether to configure an LLM provider and accepts its key through a password prompt.
- Setup writes a project AGENTS.md pointer only when one does not already exist; the text points to Cairn documentation.
Evidence against
- The setup command can install dependencies and modify project files, but these actions are part of its stated scaffolding purpose and require invoking the command.
- A new project-level AGENTS.md pointer is written when absent, but its content only links to Cairn documentation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
HighEntropyStrings
Source & flagged code
6 flaggeddist/remove.jsView file
19const node_path_1 = __importDefault(require("node:path"));
L20: const node_child_process_1 = require("node:child_process");
L21: const install_manifest_1 = require("./install-manifest");
High
dist/clack.jsView file
30// situation (used by ts-node, Jest, and others bridging CJS callers to
L31: // ESM-only packages): constructing the import call via `new Function(...)`
L32: // hides it from TypeScript's compiler entirely, so what actually runs at
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/clack.jsView on unpkg · L30dist/update.jsView file
141
Findings
1 Critical3 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/setup.js
HighChild Processdist/remove.js
HighRuntime Package Installdist/update.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/clack.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @cairnvibe/indexer@0.5.0.
See all versions of @cairnvibe/indexer for other recorded verdicts.
- Review the evidence and your use of @cairnvibe/indexer@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.