@codemarc/blt@1.10.10
blt cli
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package is not malicious by install-time behavior, but its explicit WAI feature can place remotely sourced content in broad AI-agent control files. Per policy, this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `blt wai <template>` or `blt wai sync`.
Impact
A publisher-controlled remote template can influence AI-agent instructions in the invoking project.
Mechanism
Remote-template download followed by project agent-config writes.
AI rationale
The package is not malicious by install-time behavior, but its explicit WAI feature can place remotely sourced content in broad AI-agent control files. Per policy, this warrants a warning rather than a block.
Evidence
package.jsondist/bltdist/commands/wai.jsdist/commands/wai/config.jsdist/commands/wai/config-templates.jsdist/commands/wai/multi-agent.jsSKILL.mdAGENTS.mdAGENTS.override.mdCLAUDE.md.cursor/rules/blt.mdc.claude/settings.json.mcp.json.gitignore
Network endpoints1
bltcore-com.github.io/wai
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `dist/commands/wai/config.js` fetches remote templates then writes selected project config files.
- `dist/commands/wai/config-templates.js` targets `AGENTS.md`, `.mcp.json`, `.claude/*`, and `AGENTS.override.md`.
- `dist/commands/wai/multi-agent.js` sync writes broad multi-agent instruction files and updates `.gitignore`.
- These mutations require explicit `blt wai ...` commands; no install hook invokes them.
Evidence against
- `package.json` has only `prepublishOnly`, not preinstall/install/postinstall lifecycle hooks.
- `dist/blt` only registers CLI commands and runs after direct invocation.
- Remote WAI fetch has built-in fallback templates; inspected code shows no credential exfiltration or stealth persistence.
- DigitalOcean, Supabase, SSH, and shell actions are registered as explicit deployment/admin commands.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
4 flaggeddist/lib/github.jsView file
1import { spawnSync } from "node:child_process";
L2: export function ensureGhInstalled(logger) {
High
dist/lib/digitalocean.jsView file
4import { homedir } from "node:os";
L5: const DO_API = "https://api.digitalocean.com/v2";
L6: function readDoctlToken() {
L7: const configPath = process.platform === "darwin"
L8: ? join(homedir(), "Library", "Application Support", "doctl", "config.yaml")
L9: : join(homedir(), ".config", "doctl", "config.yaml");
...
L19: function getToken() {
L20: const token = process.env.DIGITALOCEAN_ACCESS_TOKEN ??
L21: process.env.DIGITALOCEAN_TOKEN ??
...
L39: return undefined;
L40: const body = await res.text();
L41: if (!res.ok) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/lib/digitalocean.jsView on unpkg · L4Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/app/env-check.js
HighChild Processdist/lib/github.js
HighShell
HighSandbox Evasion Gated Capabilitydist/lib/digitalocean.js
HighRuntime Package Installdist/commands/deploy/functions.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @codemarc/blt@1.10.10.
See all versions of @codemarc/blt for other recorded verdicts.
- Review the evidence and your use of @codemarc/blt@1.10.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.