@gammarers/projen-projects@0.7.0
[](https://www.npmjs.com/package/@gammarers/projen-projects) [](https://www.npmjs
AI Security Review
scanned 16h ago · by lpm-firewall-aiThe shared defaults turn on automatic approval of upgrade PRs and explicitly allow the publisher account `yicr`, backed by GitHub App write permissions. This makes generated workflows approve publisher-authored PRs using the consumer's credentials by default.
Static reason
No blocking static signals were detected.
Trigger
A consumer constructs and synthesizes one of the exported project types, then its generated GitHub workflow processes a qualifying upgrade PR.
Impact
The generated workflow can use the consumer's GitHub credentials to approve PRs from the publisher account, potentially helping those changes merge.
Mechanism
Shared defaults enable upgrade auto-approval, name `yicr` as an allowed PR author, and configure GitHub App write permissions.
Attack narrative
When a consumer creates a project with one of the exported types, its generated defaults enable automatic approval of upgrade PRs and allow the publisher account `yicr`. The generated GitHub setup has write permissions for pull requests, contents, and workflows, so qualifying publisher-authored PRs can be approved using the consumer's credentials without a separate approval request.
AI rationale
The shared defaults turn on automatic approval of upgrade PRs and explicitly allow the publisher account `yicr`, backed by GitHub App write permissions. This makes generated workflows approve publisher-authored PRs using the consumer's credentials by default.
Evidence
lib/core/shared-project-defaults.jslib/projen-cdk-construct-library.jslib/projen-jsii-project.jslib/projen-typescript-project.js
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The shared project defaults enable automatic approval of upgrade PRs and include the publisher account `yicr` in the allowed usernames.
- Those defaults configure GitHub App credentials with write permissions for pull requests, repository contents, and workflows.
- Each exported project constructor passes the shared defaults into Projen, so projects created with these types inherit the approval behavior.
- The package manifest contains Projen utility scripts and no install lifecycle hooks.
Evidence against
- The package is a Projen project-type library, so generating GitHub workflows is consistent with its purpose.
- The entry point re-exports project classes; the approval behavior is added when a project is constructed, not directly by importing the package.
Behavioral surface
HighEntropyStrings
Source & flagged code
5 flaggedlib/core/shared-project-defaults.jsView file
68autoApproveUpgrades: true,
autoApproveOptions: {
allowedUsernames: [
'gammarers-projen-upgrade-bot[bot]',
exports.sharedAuthor.name,
],
},
// The development tsconfig typechecks tests with stric
High
Ai Review Evidence
The shared project defaults enable automatic approval of upgrade PRs and include the publisher account `yicr` in the allowed usernames.
lib/core/shared-project-defaults.jsView on unpkg · L6859githubOptions: {
projenCredentials: projen_1.github.GithubCredentials.fromApp({
permissions: {
pullRequests: projen_1.github.workflows.AppPermission.WRITE,
contents: projen_1.github.workflows.AppPermission.WRITE,
workflows: projen_1.github.workflows.AppPermission.WRITE,
High
Ai Review Evidence
Those defaults configure GitHub App credentials with write permissions for pull requests, repository contents, and workflows.
lib/core/shared-project-defaults.jsView on unpkg · L5943const [redacted] = () => ({
projenrcTs: true,
defaultReleaseBranch: 'main',
packageManager: projen_1.javascript.NodePackageManager.NPM,
typescriptVersion: '6.0.x',
releaseToNpm: false,
npm[redacted]: false,
npmAccess: projen_1.javascript.NpmAccess.PUBLIC,
minNodeVersion: exports.sharedNodeVersions.min,
workflowNodeVersion: exports.sharedNodeVersions.workflow,
depsUpgradeOptions: {
workflowOptions: {
labels: ['auto-approve', 'auto-merge'],
schedule: projen_1.javascr
Findings
5 High2 Low
HighAi Review Evidencelib/core/shared-project-defaults.js
HighAi Review Evidencelib/core/shared-project-defaults.js
HighAi Review Evidencelib/core/shared-project-defaults.js
HighAi Review Evidencelib/projen-cdk-construct-library.js
HighSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @gammarers/projen-projects@0.7.0.
See all versions of @gammarers/projen-projects for other recorded verdicts.
- Avoid installing @gammarers/projen-projects@0.7.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.