@delorenj/pjangler@1.4.2
Project subsystem bootstrapper CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThere is no npm install-time execution; flagged test files and the new prompt helper are not hidden payloads or credential redirection. The remaining issue is explicit user-command writing of Claude Code hooks, which is dual-use bootstrapper behavior and should warn rather than block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running pjangler notebook migrate --apply, a notebook recipe apply with policy enabled, or equivalent MCP tools after starting pjangler-mcp.
Impact
Later Claude Code sessions may run the packaged session hooks; this is consented CLI setup, not an install-time hijack.
Mechanism
Explicit user-command Claude Code hook projection
AI rationale
There is no npm install-time execution; flagged test files and the new prompt helper are not hidden payloads or credential redirection. The remaining issue is explicit user-command writing of Claude Code hooks, which is dual-use bootstrapper behavior and should warn rather than block.
Evidence
dist/index.jsdist/assets/project-notebook-skill/scripts/project-hooks.pydist/assets/project-notebook-skill/hooks/claude.settings.json~/.claude/settings.json~/.agents/skills/project-notebook/hooks/session-start.sh
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- User-invoked notebook install writes Claude Code settings by spawning python3 on a packaged projector script.
- The notebook migrate --apply command installs the skill and projects SessionStart and SessionEnd hooks.
- The packaged skill tree under dist/assets/project-notebook-skill is loaded from the CLI and copied as a digest-pinned export.
- The hook fragment registers commands under the user Project Notebook skill path.
- The projector mutates the Claude settings target when its install command runs.
Evidence against
- package.json has no preinstall, install, or postinstall scripts; only prepublishOnly for the publisher.
- tests/test_project_hooks.py is a unittest file shipped in the skill export; the runtime projector is scripts/project-hooks.py.
- dist/prompt.js is a local git and project prompt helper, not a new network or credential path.
- Prompted Telegram and Cloudflare tokens are stored with 1Password after a confirm prompt, not sent to an unofficial gateway.
- Network hosts seen in source are vendor Plane, GitHub, Telegram, Cloudflare, and Trello endpoints.
- Hook projection is skipped unless notebook policy is enabled and the user applies migrate or a matching recipe.
Source & flagged code
5 flagged · loading sourcedist/index.jsView file
•path = dist/index.js
kind = trigger_reachable_excluded_payload
sizeBytes = 853976
triggerReachableSource = dist/index.js
excludedPayload = .mise/scripts/versioning.sh
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
CREDENTIAL_KEY = /(?:^|[_-])(?:password|passwd|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|credential|authorization)(?:$|[_-])/iu;
import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync6, fchmodSync, fsyncSync, lstatSync as lstatSync5, mkdirSync as mk...
writeFileSync4(answersPath, next, "utf8");
writeFileSync4(fd, text3, "utf8");
writeFileSync4(
writeFileSync4(manifestPath, text3, "utf8");
writeFileSync4(action.path, next, "utf8");
join8(homedir4(), ".codex", "skills")
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkgFindings
1 Critical3 High3 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/index.js
HighCredential Redirect Persistencedist/index.js
HighPayload In Excluded Dirdist/assets/project-notebook-skill/tests/test_project_hooks.py
HighPrevious Version Dangerous Deltadist/prompt.js
MediumEnvironment Vars
MediumShips Build Helperdist/assets/project-notebook-skill/tests/test_project_hooks.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @delorenj/pjangler@1.4.2.
See all versions of @delorenj/pjangler for other recorded verdicts.
- Review the evidence and your use of @delorenj/pjangler@1.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.