registry / @golproductions/check / 3.1.4

@golproductions/check@3.1.4

The universal anti-hallucination engine for AI coding agents. Catches what is not real before it reaches your project.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 28.5 KB of source, external domains: github.com, golproductions.com, pub-e55366a7f5994be9be04f0e205179f4a.r2.dev, triage.golproductions.com, www.golproductions.com

Source & flagged code

6 flagged

src/index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { readFileSync, writeFileSync, mkdirSync, existsSync, createWriteStream, chmodSync, unlinkSync, rmSync } from "node:fs";

3import { join } from "node:path";

4import { homedir, platform, arch } from "node:os";

5import { pipeline } from "node:stream/promises";

6import { Readable } from "node:stream";

8const VERSION = "3.1.4";

9const BINARY_VERSION = "3.0.0";

10const API = "https://triage.golproductions.com/preflight";

11const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";

12const CLIENT_ID = process.env.GOL_CLIENT_ID || "";

14function getClientId() {

15 if (CLIENT_ID) return CLIENT_ID;

16 try {

17 const cfg = JSON.parse(readFileSync(join(homedir(), ".claude", "settings.json"), "utf8"));

18 return cfg.env?.GOL_CLIENT_ID || "";

19 } catch { return ""; }

20}

22async function validateKey(key) {

23 try {

24 const res = await fetch(API, {

25 method: "POST",

26 headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": key, "User-Agent": "c/" + VERSION },

27 body: JSON.stringify({ command: "echo check-install-verify", cwd: process.cwd(), v: VERSION }),

28 signal: AbortSignal.timeout(10000),

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

src/index.jsView on unpkg · L9

29 });

Lines 561-603javascript

561 MCP Server Provides Check and CheckAndExecute tools.

562 CLAUDE.md Adds anti-fabrication instructions.

563

564 Supported tools:

565

566 Claude Code, Gemini CLI, Cursor, Windsurf, Continue,

567 Amazon Q Developer, Roo Code, Homebase

568

569 Pricing:

570

571 120 free checks per day. Then $0.

src/mcp.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import { z } from "zod";

5import { execFile } from "node:child_process";

6import { promisify } from

Source & flagged code

6 flagged · loading source

src/index.jsView file

581try { L582: const { execSync } = await import("node:child_process"); L583: const url = "https://github.com/golproductions/check";

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L581

9const BINARY_VERSION = "3.0.0"; L10: const API = "https://triage.golproductions.com/preflight"; L11: const CDN = "https://pub-[redacted].r2.dev/releases"; L12: const CLIENT_ID = process.env.GOL_CLIENT_ID || ""; L13: ... L16: try { L17: const cfg = JSON.parse(readFileSync(join(homedir(), ".claude", "settings.json"), "utf8")); L18: return cfg.env?.GOL_CLIENT_ID || ""; ... L26: headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": key, "User-Agent": "c/" + VERSION }, L27: body: JSON.stringify({ command: "echo check-install-verify", cwd: process.cwd(), v: VERSION }), L28: signal: AbortSignal.timeout(10000), ... L46: try { user = userInfo().username || ""; } catch {}

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

src/index.jsView on unpkg · L9

583const url = "https://github.com/golproductions/check"; L584: if (platform() === "win32") execSync(`start "" "${url}"`, { stdio: "ignore", shell: true }); L585: else if (platform() === "darwin") execSync(`open "${url}"`, { stdio: "ignore" }); ... L597: L598: npx @golproductions/check --install <key> Install Check with your Client ID L599: npx @golproductions/check --uninstall Remove Check from all tools

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/index.jsView on unpkg · L583

src/mcp.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/mcp.jsView on unpkg · L4

4import { z } from "zod"; L5: import { execFile } from "node:child_process"; L6: import { promisify } from "node:util"; ... L9: const VERSION = "3.0.8"; L10: const API = "https://triage.golproductions.com/preflight"; L11: const CLIENT_ID = process.env.GOL_CLIENT_ID; ... L14: if (!CLIENT_ID) { L15: process.stderr.write("check: GOL_CLIENT_ID environment variable is required.\nGet your key at https://www.golproductions.com/check.html\n"); L16: process.exit(1);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/mcp.jsView on unpkg · L4

4import { z } from "zod"; L5: import { execFile } from "node:child_process"; L6: import { promisify } from "node:util"; ... L9: const VERSION = "3.0.8"; L10: const API = "https://triage.golproductions.com/preflight"; L11: const CLIENT_ID = process.env.GOL_CLIENT_ID; L12: const IS_WIN = process.platform === "win32"; L13: L14: if (!CLIENT_ID) { L15: process.stderr.write("check: GOL_CLIENT_ID environment variable is required.\nGet your key at https://www.golproductions.com/check.html\n"); L16: process.exit(1); ... L24: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/mcp.jsView on unpkg · L4

Findings

7 High3 Medium4 Low

HighChild Processsrc/index.js

HighShell

HighSame File Env Network Executionsrc/mcp.js

HighHost Fingerprint Exfiltrationsrc/index.js

HighCommand Output Exfiltrationsrc/mcp.js

HighSandbox Evasion Gated Capabilitysrc/mcp.js

HighRuntime Package Installsrc/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

src/index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { readFileSync, writeFileSync, mkdirSync, existsSync, createWriteStream, chmodSync, unlinkSync, rmSync } from "node:fs";

3import { join } from "node:path";

4import { homedir, platform, arch } from "node:os";

5import { pipeline } from "node:stream/promises";

6import { Readable } from "node:stream";

8const VERSION = "3.1.4";

9const BINARY_VERSION = "3.0.0";

10const API = "https://triage.golproductions.com/preflight";

11const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";

12const CLIENT_ID = process.env.GOL_CLIENT_ID || "";

14function getClientId() {

15 if (CLIENT_ID) return CLIENT_ID;

16 try {

17 const cfg = JSON.parse(readFileSync(join(homedir(), ".claude", "settings.json"), "utf8"));

18 return cfg.env?.GOL_CLIENT_ID || "";

19 } catch { return ""; }

20}

22async function validateKey(key) {

23 try {

24 const res = await fetch(API, {

25 method: "POST",

26 headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": key, "User-Agent": "c/" + VERSION },

27 body: JSON.stringify({ command: "echo check-install-verify", cwd: process.cwd(), v: VERSION }),

28 signal: AbortSignal.timeout(10000),

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

src/index.jsView on unpkg · L9

29 });

Lines 561-603javascript

561 MCP Server Provides Check and CheckAndExecute tools.

562 CLAUDE.md Adds anti-fabrication instructions.

563

564 Supported tools:

565

566 Claude Code, Gemini CLI, Cursor, Windsurf, Continue,

567 Amazon Q Developer, Roo Code, Homebase

568

569 Pricing:

570

571 120 free checks per day. Then $0.

src/mcp.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import { z } from "zod";

5import { execFile } from "node:child_process";

6import { promisify } from