registry / @eventmodelers/cli / 2.0.27
@eventmodelers/cli@2.0.27
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package exposes a CLI without install hooks. Its credential use targets the configured Eventmodelers API, while the unofficial agent endpoint is optional and user-selected; project agent configuration changes occur during explicit setup.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs a CLI command such as run, init --prototype, or run --agent mastra.
Impact
Expected board operations, agent execution, and project setup.
Mechanism
The CLI uses configured board credentials with the Eventmodelers API; an optional Mastra endpoint and key are supplied through user configuration and environment.
AI rationale
The package exposes a CLI without install hooks. Its credential use targets the configured Eventmodelers API, while the unofficial agent endpoint is optional and user-selected; project agent configuration changes occur during explicit setup.
Evidence
~/.eventmodelers/boards/<boardId>.json.claude/settings.local.jsonCLAUDE.md
Network endpoints2
api.eventmodelers.aiapi.franconia.ai/v1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hooks; it exposes cli.js as a command-line executable.
- The default board API is api.eventmodelers.ai, and the CLI sends the Eventmodelers token to the configured board API for its intended account operation.
- The Franconia endpoint is an optional Mastra endpoint; its API key comes from MASTRA_API_KEY, and the endpoint is set from the user's --endpoint argument.
- Prototype setup is an explicit init operation that installs project skills and permission settings; the source says Claude is started by the user.
Evidence against
- The CLI can execute shell commands and run agent harnesses, but these are user-selected runtime features of the agent CLI.
- The prototype extension writes Claude project configuration, but only as part of its explicit setup workflow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
12 flaggedstacks/supabase/templates/root/src/common/testHelpers.tsView file
1import {execSync} from 'child_process';
L2: import {readFileSync, writeFileSync, unlinkSync} from 'fs';
High
Child Process
Package source references child process execution.
stacks/supabase/templates/root/src/common/testHelpers.tsView on unpkg · L1shared/build-kit/ralph-exec.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @eventmodelers/cli@2.0.25
matchedIdentity = npm:QGV2ZW50bW9kZWxlcnMvY2xp:2.0.25
similarity = 0.958
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
shared/build-kit/ralph-exec.jsView on unpkgFindings
1 Critical8 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltashared/build-kit/ralph-exec.js
HighChild Processstacks/supabase/templates/root/src/common/testHelpers.ts
HighShellshared/build-kit/ralph-exec.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighCredential Redirect Persistencecli.js
HighExternal Ai Agent Control Surface Mutationcli.js
HighTrigger Reachable External Ai Agent Control Surface Mutationextensions/prototype/index.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/supabase/templates/root/server.ts
Affected versions and remediation
This report applies to @eventmodelers/cli@2.0.27.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@2.0.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.