registry / @koda-sl/baker-cli
@koda-sl/baker-cli
AI-agent-first CLI for interacting with Baker, including the Baker creative canvas.
This report shows the evidence for @koda-sl/baker-cli@0.681.0. 0 of 301 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 23h ago · by lpm-firewall-aiThe package is an AI and creative-work CLI whose observed credential use is directed to the corresponding model service for feature inputs. The scanner’s Unicode lead is a legitimate identifier regex, and the manifest has no install lifecycle hook.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Relevant requests occur when a user invokes model-assisted or flow commands; no install hook is declared.
Impact
No malicious impact identified; the observed data is used by the invoked features, and no unrelated credential transfer was found.
Mechanism
Model requests send the configured OpenRouter key and feature inputs to OpenRouter; the documented render check sends captured frames to Gemini through HyperFrames.
AI rationale
The package is an AI and creative-work CLI whose observed credential use is directed to the corresponding model service for feature inputs. The scanner’s Unicode lead is a legitimate identifier regex, and the manifest has no install lifecycle hook.
Network endpoints1
openrouter.ai
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and engine entry point and declares only build, development, typecheck, export, and test scripts; no install lifecycle script is present.
- The OpenRouter credential is read from OPENROUTER_API_KEY and sent as a bearer token to OpenRouter for model requests.
- The README describes a render check that sends captured frames to Gemini and uses GEMINI_API_KEY for that feature.
- The flagged invisible characters occur in a Unicode identifier-validation regex for flow step names.
Evidence against
- Runtime model calls transmit prompts or images and an OpenRouter key to openrouter.ai.
- The render smoke test passes the environment to HyperFrames, which uses GEMINI_API_KEY for frame analysis.
- Flow commands read and write project flow files and may request decrypted destination settings through the Baker API.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggeddist/chunk-2DNX3Z5X.jsView file
59patternName = generic_password
severity = medium
line = 59
Medium
60patternName = generic_password
severity = medium
line = 60
Medium
dist/chunk-O6YJECEA.jsView file
1553// [redacted].ts
L1554: var require_ = createRequire(import.meta.url);
L1555: var DEFAULT_SPECIMEN = [
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-O6YJECEA.jsView on unpkg · L1553Findings
2 Critical1 High6 Medium6 Low
CriticalTrojan Source Unicodedist/chunk-SR4IVUCH.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-SR4IVUCH.js
HighSemantic Analysis Limiteddist/add-RGOKJ6K2.js#virtual:string-array:round1
MediumSecret Patterndist/chunk-2DNX3Z5X.js
MediumDynamic Requiredist/chunk-O6YJECEA.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/chunk-2DNX3Z5X.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Low
Affected versions and remediation
This report applies to @koda-sl/baker-cli@0.681.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @koda-sl/baker-cli@0.681.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.