@kaydash9999/banker-plugins@0.22.0
banker — Claude Code + Codex CLI plugin (QA, audit, docs, architecture, wiki skills). Install via Claude Code marketplace, or `npm i -g @kaydash9999/banker-plugins` then `banker setup`.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI performs an account action toward a publisher-selected repository using the user's GitHub credentials, with an opt-out prompt whose default triggers the action. This meets the malicious account-action rule.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running banker setup interactively on a first run; pressing Enter accepts the default.
Impact
The user's GitHub account performs an unsolicited action on a publisher-selected repository unless the user explicitly declines.
Mechanism
The CLI runs gh api with PUT against /user/starred/smallOpenSource/banker_plugins.
Attack narrative
On first interactive `banker setup`, the prompt treats an empty response as approval and invokes `gh` using the user's configured GitHub account. It sends a PUT request to star the publisher's repository. The user must enter `n` to prevent the action.
AI rationale
The CLI performs an account action toward a publisher-selected repository using the user's GitHub credentials, with an opt-out prompt whose default triggers the action. This meets the malicious account-action rule.
Evidence
bin/banker.js
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI uses the authenticated GitHub CLI to PUT to the starred-repositories endpoint for the publisher's repository.
- On first interactive setup, an empty response to the [Y/n] star prompt is treated as approval and invokes the star action.
Evidence against
- The star action is presented in an interactive first-run prompt and can be declined by entering n.
- The manifest has no install, preinstall, or postinstall hook; its prepublishOnly script only checks package version synchronization.
- Usage counting is disclosed and has documented opt-out controls.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/banker.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
claude cli not found on path — install claude code first. skipping --claude.'); return false; }
const steps = [
['claude', ['plugin', 'marketplace', 'add', pkg_root]],
['claude', ['plugin', 'install', `${plugin_name}@${marketplace}`]],
];
for (const [bin, args] of steps) {
if (dryrun) { log(` [dry-run] ${bin} ${args.join(' ')}`); continue; }
try { cp.execfilesync(bin, args, { stdio: 'inherit' }); }
catch (e) { warn(` step failed (may already be applied): ${bin} ${args.join(' ')}`); }
}
log(' → skills/commands available as /banker:* (reload-plugins or restart to apply).');
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/banker.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @kaydash9999/banker-plugins@0.20.5
matchedIdentity = npm:[redacted]:0.20.5
similarity = 0.862
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/banker.jsView on unpkgFindings
3 High5 Medium6 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/banker.js
HighSemantic Analysis Limitedcodex/skills/progress/scripts/progress.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltabin/banker.js
MediumDynamic Requirebin/banker.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/audit-web-page/harness.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoskills/payload-mon/scripts/payload-size.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @kaydash9999/banker-plugins@0.22.0.
See all versions of @kaydash9999/banker-plugins for other recorded verdicts.
- Avoid installing @kaydash9999/banker-plugins@0.22.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.