registry / @delorenj/pjangler / 1.5.13

@delorenj/pjangler@1.5.13

Project subsystem bootstrapper CLI

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source inspection found no npm install lifecycle trigger or concrete malicious behavior. The flagged agent integration and service setup are explicit package operations, while the excluded-path payload is test code using local temporary fixtures.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the notebook integration or registry installer.

Impact

These operations change user configuration when invoked, but inspected source does not establish an unconsented install-time attack.

Mechanism

The notebook integration installs the package-owned skill and projects hooks; the separate installer creates and enables a user systemd service.

AI rationale

Evidence

package.jsondist/index.jsdist/mcp-server.jsdist/notebook/journal-service-main.jsscripts/install-project-registry.mjsdist/assets/project-notebook-skill/tests/test_project_hooks.py

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no preinstall, install, or postinstall hook; prepublishOnly runs checks and a build.
The flagged locations in the three bundles contain shared skill-root and registry-key constants, not agent configuration writes.
Notebook skill and hook installation is exposed through an integration method, not an npm lifecycle hook.
The registry service installer is a separate script that creates a user systemd unit when invoked.
The flagged Python file is a test module that uses a temporary directory and local hook fixtures.

Evidence against

The bundles include code for installing a first-party notebook skill and projecting hooks into Claude settings when the integration is invoked.
The separate registry installer enables a user systemd service when run.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

8 flagged

dist/index.jsView file

•path = dist/index.js kind = trigger_reachable_excluded_payload sizeBytes = 896389 triggerReachableSource = dist/index.js excludedPayload = .mise/scripts/versioning.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/index.jsView on unpkg

121// src/project/registryClient.ts L122: import { spawnSync } from "node:child_process"; L123: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L121

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: CREDENTIAL_KEY = /(?:^|[_-])(?:password|passwd|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|credential|authorization)(?:$|[_-])/iu; `no Plane API key for workspace "${workspace}": set ${planeApiKeyNames(workspace).join(" or ")}, or add one to ${ctx.env.HERMES_FLEET_ENV?.trim() || join11(ctx.home, ".hermes", "fl... `Plane returned ${response.status} for ${path}` + (credentials ? ` \u2014 the API key was rejected; check ${planeApiKeyNames(client.workspace).join(" / ")}` : response.status === 4... import { chmodSync as chmodSync2, closeSync, copyFileSync as copyFileSync2, existsSync as ex

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

7369if (typeof bin !== "string" || !bin) throw new Error(`${manifestPath} declares no skillex bin`); L7370: return { bin: resolve4(dirname4(manifestPath), bin), version: String(manifest.version ?? "unknown") }; L7371: } ... L7377: } catch (error) { L7378: process.stderr.write(`pjangler install is missing its @delorenj/skillex dependency (${error instanceof Error ? error.message : String(error)}); reinstall @delorenj/pjangler L7379: `); ... L7382: return await new Promise((resolveOutcome) => { L7383: const child = spawn(process.execPath, [cli.bin, ...args], { stdio: "inherit" }); L7384: const relay = (signal) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L7369

7369Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L7369: if (typeof bin !== "string" || !bin) throw new Error(`${manifestPath} declares no skillex bin`); L7370: return { bin: resolve4(dirname4(manifestPath), bin), version: String(manifest.version ?? "unknown") }; L7371: } ... L7377: } catch (error) { L7378: process.stderr.write(`pjangler install is missing its @delorenj/skillex dependency (${error instanceof Error ? error.message : String(error)}); reinstall @delorenj/pjangler L7379: `); ... L7382: return await new Promise((resolveOutcome) => { L7383: const child = spawn(process.execPath, [cli.bin, ...args], { stdio: "inherit" }); L7384: const relay = (signal) => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L7369

scripts/install-project-registry.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, writeFileSync } from 'node:fs';

3import { homedir, userInfo } from 'node:os';

4import { dirname, join, resolve } from 'node:path';

5import { fileURLToPath }

dist/assets/project-notebook-skill/tests/test_project_hooks.pyView file

•path = dist/assets/project-notebook-skill/tests/test_project_hooks.py kind = payload_in_excluded_dir sizeBytes = 38660 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/assets/project-notebook-skill/tests/test_project_hooks.pyView on unpkg

•path = dist/assets/project-notebook-skill/tests/test_project_hooks.py kind = build_helper sizeBytes = 38660 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/assets/project-notebook-skill/tests/test_project_hooks.pyView on unpkg

Source & flagged code

8 flagged · loading source

dist/index.jsView file

•path = dist/index.js kind = trigger_reachable_excluded_payload sizeBytes = 896389 triggerReachableSource = dist/index.js excludedPayload = .mise/scripts/versioning.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/index.jsView on unpkg

121// src/project/registryClient.ts L122: import { spawnSync } from "node:child_process"; L123: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L121

Findings

1 Critical6 High4 Medium5 Low

CriticalTrigger Reachable Excluded Directory Payloaddist/index.js

HighChild Processdist/index.js

HighSame File Env Network Executionscripts/install-project-registry.mjs

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighPayload In Excluded Dirdist/assets/project-notebook-skill/tests/test_project_hooks.py

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/assets/project-notebook-skill/tests/test_project_hooks.py

MediumStructural Risk Force Deep Review

Low

Affected versions and remediation

This report applies to @delorenj/pjangler@1.5.13.

See all versions of @delorenj/pjangler for other recorded verdicts.

Review the evidence and your use of @delorenj/pjangler@1.5.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 04:25:55.047Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.