registry / @eventmodelers/cli / 1.0.101
@eventmodelers/cli@1.0.101
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior. The flagged agent configuration, network use, and process execution align with explicit CLI, project, and build functions.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI setup or runtime commands, or invokes the project build check.
Impact
The inspected behavior supports the package’s CLI, agent integration, and build functions; no malicious data transfer or unauthorized mutation was established.
Mechanism
The package configures project-level agent access, connects to the configured Eventmodelers service, or runs selected project tools.
AI rationale
Source inspection found no install lifecycle hook or concrete attack behavior. The flagged agent configuration, network use, and process execution align with explicit CLI, project, and build functions.
Evidence
package.jsoncli.jsshared/build-kit/lib/mcp-register.jsshared/build-kit/lib/adapters/supabase-realtime-adapter.jsstacks/bridge/templates/bridge/ralph-local-ai.jsstacks/bridge/templates/bridge/ralph-hook.jsshared/build-kit/code-export.mjsstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjslib/adapters/spec-kitty-adapter.js
Network endpoints1
api.eventmodelers.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no install lifecycle hook; its only script is test.
- The CLI’s agent-host entries identify project command and skill locations, and the MCP registration helper describes project-scoped configuration using environment-variable references.
- The Supabase adapter authenticates to the configured service and subscribes to caller-specified broadcast topics and handlers.
- The local AI runner starts its selected local agent process with the project directory and current environment; the bridge hook runs a configured command.
- The code-export helper uses git to inspect a project, and the TypeScript check invokes the project’s compiler as part of build validation.
- The Spec Kitty adapter constructs its data request from the configured service URL and board/context identifiers.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggedstacks/bridge/templates/bridge/ralph-local-ai.jsView file
12import { startRalph } from './lib/ralph.js';
L13: import { spawn } from 'child_process';
L14: import { dirname, join, resolve } from 'path';
High
Child Process
Package source references child process execution.
stacks/bridge/templates/bridge/ralph-local-ai.jsView on unpkg · L12stacks/bridge/templates/bridge/ralph-hook.jsView file
68cwd: projectDir,
L69: shell: true,
L70: stdio: 'inherit',
High
Shell
Package source references shell execution.
stacks/bridge/templates/bridge/ralph-hook.jsView on unpkg · L68stacks/bridge/templates/bridge/ralph-static.jsView file
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/bridge/templates/bridge/ralph-local-ai.js
HighShellstacks/bridge/templates/bridge/ralph-hook.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/bridge/templates/bridge/ralph-static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
Affected versions and remediation
This report applies to @eventmodelers/cli@1.0.101.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@1.0.101 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.