registry / @koda-sl/baker-cli / 0.612.0
@koda-sl/baker-cli@0.612.0
AI-agent-first CLI for interacting with Baker, including the Baker creative canvas.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest exposes a Baker CLI with no install hook, and the flagged subprocess calls handle media review. The credentialed network request uses OpenRouter and is reached by a review operation on supplied media, consistent with the package’s stated purpose.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes a rendering review operation with media to review; the network call also requires OPENROUTER_API_KEY.
Impact
The requested media is processed by OpenRouter for review; no unrelated collection or automatic install-time action was identified.
Mechanism
The review code extracts stills or reads the supplied video and sends review prompts and media to https://openrouter.ai/api/v1/chat/completions using the OpenRouter key.
AI rationale
The manifest exposes a Baker CLI with no install hook, and the flagged subprocess calls handle media review. The credentialed network request uses OpenRouter and is reached by a review operation on supplied media, consistent with the package’s stated purpose.
Network endpoints1
openrouter.ai/api/v1/chat/completions
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Baker CLI and exposes its command and engine entry points; it contains no install lifecycle hook.
- The rendering gateway reads OPENROUTER_API_KEY and returns without making a request when the key is absent.
- When used, the rendering gateway sends requests to OpenRouter, the credential’s own service.
- Video review reads the supplied video and passes it to the review gateway; the review path invokes it with opts.video.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/chunk-SIQSBP7Y.jsView file
59patternName = generic_password
severity = medium
line = 59
Medium
60patternName = generic_password
severity = medium
line = 60
Medium
dist/chunk-PGCQJR7X.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @koda-sl/baker-cli@0.537.0
matchedIdentity = npm:QGtvZGEtc2wvYmFrZXItY2xp:0.537.0
similarity = 0.433
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Findings
3 Critical4 High6 Medium6 Low
CriticalTrojan Source Unicodedist/chunk-DKWKD3WW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-DKWKD3WW.js
CriticalPrevious Version Dangerous Deltadist/chunk-PGCQJR7X.js
HighChild Processdist/chunk-PGCQJR7X.js
HighCommand Output Exfiltrationdist/chunk-YK23XHK4.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/chunk-YK23XHK4.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/chunk-SZCVDOWB.js#virtual:normalized:round1
MediumSecret Patterndist/chunk-SIQSBP7Y.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @koda-sl/baker-cli@0.612.0.
See all versions of @koda-sl/baker-cli for other recorded verdicts.
- Review the evidence and your use of @koda-sl/baker-cli@0.612.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.