registry / @cairnvibe/indexer / 0.5.1
@cairnvibe/indexer@0.5.1
Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package declares no install lifecycle hook, and importing its library entry point only exposes functions. The flagged installs and project writes are part of the explicit setup workflow, while provider requests analyze project pages using a provider and key selected by the user.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Project edits, package installs and manifest generation occur through explicit CLI commands such as cairn setup or cairn build.
Impact
No unauthorized credential collection, unrelated account actions, or concealed automatic behavior was identified.
Mechanism
Setup asks the user to select an LLM provider and supply its key; the analyzer sends page source and UI data to that provider to produce descriptions.
AI rationale
The package declares no install lifecycle hook, and importing its library entry point only exposes functions. The flagged installs and project writes are part of the explicit setup workflow, while provider requests analyze project pages using a provider and key selected by the user.
Evidence
.envAGENTS.md.cairn/CAIRN.md
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a CLI and library entry point, with no install lifecycle script.
- Importing dist/index.js exposes library functions; command actions are dispatched only when the CLI receives the corresponding command.
- cairn setup prompts the user to choose an LLM provider before requesting its key.
- The build sends page source and UI element data to the selected LLM provider to generate page descriptions.
- Setup writes a root AGENTS.md only when one does not already exist, and its stub points to the generated Cairn reference document.
Evidence against
- cairn setup installs packages, writes project configuration and may build a manifest; these actions are tied to the explicit setup command.
- Manifest generation sends up to 12,000 characters of project source per page to the selected provider, consistent with the analyzer’s stated purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Source & flagged code
6 flaggeddist/remove.jsView file
19const node_path_1 = __importDefault(require("node:path"));
L20: const node_child_process_1 = require("node:child_process");
L21: const install_manifest_1 = require("./install-manifest");
High
dist/clack.jsView file
30// situation (used by ts-node, Jest, and others bridging CJS callers to
L31: // ESM-only packages): constructing the import call via `new Function(...)`
L32: // hides it from TypeScript's compiler entirely, so what actually runs at
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/clack.jsView on unpkg · L30dist/update.jsView file
141
Findings
1 Critical3 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/setup.js
HighChild Processdist/remove.js
HighRuntime Package Installdist/update.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/clack.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @cairnvibe/indexer@0.5.1.
See all versions of @cairnvibe/indexer for other recorded verdicts.
- Review the evidence and your use of @cairnvibe/indexer@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.