registry / @jay-framework/aiditor / 0.21.0

@jay-framework/aiditor@0.21.0

AIditor — visual AI-driven code editor plugin for Jay Framework

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User opens /aiditor or invokes exported Jay actions such as submitTask, ensureProjectPlugin, setupAiditor, or readFile

Impact

Potential project source modification and command execution under the user's project context if the AIditor UI/actions are used

Mechanism

user-invoked AI agent and plugin-management actions with filesystem and shell capabilities

Rationale

The scanner's child_process and install findings are real, but they are part of an explicit AI editor/plugin-management feature and there are no lifecycle hooks or covert payload behavior. Because the package grants an AI agent broad project editing and Bash capability when used, treat it as suspicious/dangerous capability rather than malicious.

Evidence

package.jsonplugin.yamlREADME.mddist/index.jsbuild/aditor/route-sessions.json.aiditor/page-requests/*.aiditor/plugin-setup-status.json.aiditor/plugin-sources.yamlagent-kit/plugin/aiditor-add-menu.mdagent-kit/plugin/INSTRUCTIONS.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js imports @anthropic-ai/claude-agent-sdk and runs query() with Read/Edit/Write/Bash/Glob/Grep tools for user tasks
dist/index.js exposes readFileAction that reads an input filePath and returns text or base64 image data
dist/index.js has user-invoked plugin install/update flows spawning yarn/npm/npx and writing .aiditor/plugin-setup-status.json
plugin.yaml setup handler copies aiditor-add-menu.md and may append agent-kit/plugin/INSTRUCTIONS.md

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks
Runtime shell/package-manager use is behind exported Jay actions, not import-time or install-time execution
Network references are package-aligned: Claude Agent SDK use and npm version lookup/install for selected Jay plugins
No credential harvesting, obfuscated payload, persistence, destructive file removal, or hardcoded exfiltration endpoint found
AI-agent setup writes first-party AIditor guidance under agent-kit/plugin, not a foreign broad control-surface takeover

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.02 MB of source, external domains: aiditor.local, www.w3.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-33javascript

1var __defProp = Object.defineProperty;

2var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;

3var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);

4import { makeJayQuery, makeJayStream, makeJayStackComponent, phaseOutput, RenderPipeline } from "@jay-framework/fullstack-component";

5import { DEV_SERVER_SERVICE } from "@jay-framework/dev-server";

6import fs, { readFile, readdir } from "fs/promises";

7import path, { extname } from "path";

8import { query } from "@anthropic-ai/claude-agent-sdk";

9import fs$1 from "fs";

10import crypto from "crypto";

11import yaml, { load } from "js-yaml";

12import { getLogger } from "@jay-framework/logger";

13import { fileURLToPath } from "url";

14import { spawn } from "child_process";

15import { scanRoutes } from "@jay-framework/stack-route-scanner";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16import { parseContract, ContractTagType } from "@jay-framework/compiler-jay-html";

17import { checkValidationErrors } from "@jay-framework/compiler-shared";

18import { setActionCallerOptions } from "@jay-framework/stack-client-runtime";

19const getAiditorBootstrap = makeJayQuery(

20 "aiditor.getAiditorBootstrap"

21).withHandler(async (input) => {

22 return {

23 projectDir: process.cwd(),

24 httpBaseUrl: input.origin.trim()

25 };

26});

27const getProjectInfoAction = makeJayQuery("aditor.getProjectInfo").withServices(DEV_SERVER_SERVICE).withHandler(async (input, devServer) => {

28 const routes = await devServer.refreshRoutes();

29 return { routes, httpBaseUrl: input.jayDevUrl };

30});

31const getPageParamsAction = makeJayStream("aditor.getPageParams").withServices(DEV_SERVER_SERVICE).withHandler(async function* (input, devServer) {

32 for await (const batch of devServer.loadRouteParams(input.route)) {

33 yield batch;

Lines 1858-1900javascript

1858 return {

1859 valid: false,

1860 error: "Dynamic segments must have a param name, e.g. [slug]."

1861 };

1862 }

1863 if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(inner)) {

1864 return {

1865 valid: false,

•matchType = previous_version_dangerous_delta matchedPackage = @jay-framework/aiditor@0.20.0 matchedIdentity = npm:QGpheS1mcmFtZXdvcmsvYWlkaXRvcg:0.20.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

13import { fileURLToPath } from "url"; L14: import { spawn } from "child_process"; L15: import { scanRoutes } from "@jay-framework/stack-route-scanner";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

1880cwd: projectDir, L1881: shell: true, L1882: env: process.env

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1880

1878return new Promise((resolve) => { L1879: const child = spawn("npx", ["jay-stack-cli", "validate"], { L1880: cwd: projectDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L1878

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-33javascript

1var __defProp = Object.defineProperty;

2var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;

3var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);

4import { makeJayQuery, makeJayStream, makeJayStackComponent, phaseOutput, RenderPipeline } from "@jay-framework/fullstack-component";

5import { DEV_SERVER_SERVICE } from "@jay-framework/dev-server";

6import fs, { readFile, readdir } from "fs/promises";

7import path, { extname } from "path";

8import { query } from "@anthropic-ai/claude-agent-sdk";

9import fs$1 from "fs";

10import crypto from "crypto";

11import yaml, { load } from "js-yaml";

12import { getLogger } from "@jay-framework/logger";

13import { fileURLToPath } from "url";

14import { spawn } from "child_process";

15import { scanRoutes } from "@jay-framework/stack-route-scanner";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16import { parseContract, ContractTagType } from "@jay-framework/compiler-jay-html";

17import { checkValidationErrors } from "@jay-framework/compiler-shared";

18import { setActionCallerOptions } from "@jay-framework/stack-client-runtime";

19const getAiditorBootstrap = makeJayQuery(

20 "aiditor.getAiditorBootstrap"

21).withHandler(async (input) => {

22 return {

23 projectDir: process.cwd(),

24 httpBaseUrl: input.origin.trim()

25 };

26});

27const getProjectInfoAction = makeJayQuery("aditor.getProjectInfo").withServices(DEV_SERVER_SERVICE).withHandler(async (input, devServer) => {

28 const routes = await devServer.refreshRoutes();

29 return { routes, httpBaseUrl: input.jayDevUrl };

30});

31const getPageParamsAction = makeJayStream("aditor.getPageParams").withServices(DEV_SERVER_SERVICE).withHandler(async function* (input, devServer) {

32 for await (const batch of devServer.loadRouteParams(input.route)) {

33 yield batch;

Lines 1858-1900javascript

1858 return {

1859 valid: false,

1860 error: "Dynamic segments must have a param name, e.g. [slug]."

1861 };

1862 }

1863 if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(inner)) {

1864 return {

1865 valid: false,

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg