registry / Malware / @kaydash9999/banker-plugins

@kaydash9999/banker-plugins

banker — Claude Code + Codex CLI plugin (QA, audit, docs, architecture, wiki skills). Install via Claude Code marketplace, or `npm i -g @kaydash9999/banker-plugins` then `banker setup`.

This report shows the evidence for @kaydash9999/banker-plugins@0.22.0. 1 of 30 known versions is blocked or flagged. The newest version, 0.25.1, is allowed. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The CLI performs an account action toward a publisher-selected repository using the user's GitHub credentials, with an opt-out prompt whose default triggers the action. This meets the malicious account-action rule.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running banker setup interactively on a first run; pressing Enter accepts the default.

Impact

The user's GitHub account performs an unsolicited action on a publisher-selected repository unless the user explicitly declines.

Mechanism

The CLI runs gh api with PUT against /user/starred/smallOpenSource/banker_plugins.

Attack narrative

On first interactive `banker setup`, the prompt treats an empty response as approval and invokes `gh` using the user's configured GitHub account. It sends a PUT request to star the publisher's repository. The user must enter `n` to prevent the action.

AI rationale

Evidence

bin/banker.js

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The CLI uses the authenticated GitHub CLI to PUT to the starred-repositories endpoint for the publisher's repository.
On first interactive setup, an empty response to the [Y/n] star prompt is treated as approval and invokes the star action.

Evidence against

The star action is presented in an interactive first-run prompt and can be declined by entering n.
The manifest has no install, preinstall, or postinstall hook; its prepublishOnly script only checks package version synchronization.
Usage counting is disclosed and has documented opt-out controls.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 1.50 MB of source, external domains: banker.banker-plugins.workers.dev, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

6 flagged

bin/banker.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. claude cli not found on path — install claude code first. skipping --claude.'); return false; } const steps = [ ['claude', ['plugin', 'marketplace', 'add', pkg_root]], ['claude', ['plugin', 'install', `${plugin_name}@${marketplace}`]], ]; for (const [bin, args] of steps) { if (dryrun) { log(` [dry-run] ${bin} ${args.join(' ')}`); continue; } try { cp.execfilesync(bin, args, { stdio: 'inherit' }); } catch (e) { warn(` step failed (may already be applied): ${bin} ${args.join(' ')}`); } } log(' → skills/commands available as /banker:* (reload-plugins or restart to apply).');

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/banker.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @kaydash9999/banker-plugins@0.20.5 matchedIdentity = npm:[redacted]:0.20.5 similarity = 0.862 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/banker.jsView on unpkg

Findings

3 High5 Medium6 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/banker.js

HighSemantic Analysis Limitedcodex/skills/progress/scripts/progress.mjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltabin/banker.js

MediumDynamic Requirebin/banker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/audit-web-page/harness.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoskills/payload-mon/scripts/payload-size.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @kaydash9999/banker-plugins@0.22.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @kaydash9999/banker-plugins@0.22.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 02:14:17.013Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

30 known versions

0.25.1latestClean—AllowPublishedNov 3, 2026, 5:03 AM 0.25.0Clean—AllowPublishedNov 2, 2026, 12:39 PM 0.24.1Clean—AllowPublishedNov 2, 2026, 4:58 AM 0.23.3Clean—AllowPublishedOct 31, 2026, 10:35 AM

registry / Malware / @kaydash9999/banker-plugins

@kaydash9999/banker-plugins

banker — Claude Code + Codex CLI plugin (QA, audit, docs, architecture, wiki skills). Install via Claude Code marketplace, or `npm i -g @kaydash9999/banker-plugins` then `banker setup`.

This report shows the evidence for @kaydash9999/banker-plugins@0.22.0. 1 of 30 known versions is blocked or flagged. The newest version, 0.25.1, is allowed. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running banker setup interactively on a first run; pressing Enter accepts the default.

Impact

The user's GitHub account performs an unsolicited action on a publisher-selected repository unless the user explicitly declines.

Mechanism

The CLI runs gh api with PUT against /user/starred/smallOpenSource/banker_plugins.

Attack narrative

AI rationale

Evidence

bin/banker.js

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The CLI uses the authenticated GitHub CLI to PUT to the starred-repositories endpoint for the publisher's repository.
On first interactive setup, an empty response to the [Y/n] star prompt is treated as approval and invokes the star action.

Evidence against

The star action is presented in an interactive first-run prompt and can be declined by entering n.
The manifest has no install, preinstall, or postinstall hook; its prepublishOnly script only checks package version synchronization.
Usage counting is disclosed and has documented opt-out controls.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 1.50 MB of source, external domains: banker.banker-plugins.workers.dev, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

6 flagged

bin/banker.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/banker.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/banker.jsView on unpkg

Findings

3 High5 Medium6 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/banker.js

HighSemantic Analysis Limitedcodex/skills/progress/scripts/progress.mjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltabin/banker.js

MediumDynamic Requirebin/banker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/audit-web-page/harness.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoskills/payload-mon/scripts/payload-size.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @kaydash9999/banker-plugins@0.22.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @kaydash9999/banker-plugins@0.22.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 02:14:17.013Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

30 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages