registry / @leanandmean/coding-agent / 0.74.1-scramjet.55
@leanandmean/coding-agent@0.74.1-scramjet.55
Coding agent CLI with read, bash, edit, write tools and session management
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no install hook or concrete malicious chain. Potentially powerful command and local-example behaviors are package-aligned and user-invoked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
User invocation of the coding-agent CLI or an example extension.
Impact
No unconsented persistence, credential exfiltration, destructive action, or remote payload execution was established.
Mechanism
The package can run user-requested commands and local example integrations; package installation has no lifecycle script.
AI rationale
Static inspection found no install hook or concrete malicious chain. Potentially powerful command and local-example behaviors are package-aligned and user-invoked.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata defines only build and test scripts, with no install lifecycle hook.
- The command runner executes supplied command arguments with shell mode disabled by default.
- The macOS theme example is explicitly loaded by a user command and only updates the UI theme.
- The bundled Doom file is a local module factory used by an example, not an install-time loader.
- Shell utilities only construct the process environment and PATH for the CLI.
- The notification example emits a local terminal or Windows toast when an agent session ends.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flaggeddist/core/exec.jsView file
3*/
L4: import { spawn } from "node:child_process";
L5: import { StringDecoder } from "node:string_decoder";
High
examples/extensions/mac-system-theme.tsView file
11L12: const execAsync = promisify(exec);
L13:
High
Shell
Package source references shell execution.
examples/extensions/mac-system-theme.tsView on unpkg · L11examples/extensions/doom-overlay/doom-engine.tsView file
Findings
8 High5 Medium5 Low
HighChild Processdist/core/exec.js
HighShellexamples/extensions/mac-system-theme.ts
HighCommand Output Exfiltrationexamples/extensions/doom-overlay/doom/build/doom.js
HighSemantic Analysis Limiteddist/utils/shell.js#virtual:normalized:round1
HighKnown Malware Source Similarityexamples/extensions/doom-overlay/doom/build/doom.js
HighKnown Malware Source Similarityexamples/extensions/notify.ts
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
HighKnown Malware Source Similarityexamples/extensions/github-issue-autocomplete.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm
Affected versions and remediation
This report applies to @leanandmean/coding-agent@0.74.1-scramjet.55.
See all versions of @leanandmean/coding-agent for other recorded verdicts.
- Review the evidence and your use of @leanandmean/coding-agent@0.74.1-scramjet.55 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.