registry / @leanandmean/coding-agent / 0.74.1-scramjet.58
@leanandmean/coding-agent@0.74.1-scramjet.58
⚠ Under reviewCoding agent CLI with read, bash, edit, write tools and session management
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected package.json, the CLI entry, and startup migrations show no install hook, self-dependency lifecycle chain, or hidden exfiltration. The verdict stays manual_review because the mandated clean citation list exceeds the eight-citation cap, which is a review constraint rather than an attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
No npm lifecycle or import-time trigger was found. Agent code runs when the user starts dist/cli.js.
Impact
No confirmed unconsented install mutation, credential export, or remote payload execution was established. The review stays unresolved only because clean citation coverage cannot fit.
Mechanism
package.json has no install scripts. Migrations and command execution occur inside the launched CLI, not during package installation.
AI rationale
Inspected package.json, the CLI entry, and startup migrations show no install hook, self-dependency lifecycle chain, or hidden exfiltration. The verdict stays manual_review because the mandated clean citation list exceeds the eight-citation cap, which is a review constraint rather than an attack.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json scripts are only clean, dev, build, copy-assets, and test; there is no preinstall, install, or postinstall hook and no bin field.
- dist/cli.js invokes main only with the process argv when the CLI entry is run.
- runMigrations(process.cwd()) runs inside the launched main function, after user startup, and rewrites this product's own agent auth and settings files.
- The required clean citation list has nine paths while sourceCitations allows eight, so a mark_clean result cannot be emitted even though no independent attack chain was found.
Evidence against
- Dependencies are sibling @leanandmean packages plus ordinary libraries, not a runtime self-dependency on this package name.
- Shell spawn, file writes, and example extensions such as notify and macOS theme sync are coding-agent features reached only after the user starts the CLI or loads an example.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
12 flaggeddist/core/exec.jsView file
3*/
L4: import { spawn } from "node:child_process";
L5: import { StringDecoder } from "node:string_decoder";
High
examples/extensions/mac-system-theme.tsView file
11L12: const execAsync = promisify(exec);
L13:
High
Shell
Package source references shell execution.
examples/extensions/mac-system-theme.tsView on unpkg · L11examples/extensions/doom-overlay/doom-engine.tsView file
Findings
1 Critical8 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/main.js
HighChild Processdist/core/exec.js
HighShellexamples/extensions/mac-system-theme.ts
HighCommand Output Exfiltrationexamples/extensions/doom-overlay/doom/build/doom.js
HighSemantic Analysis Limiteddist/utils/shell.js#virtual:normalized:round1
HighKnown Malware Source Similarityexamples/extensions/doom-overlay/doom/build/doom.js
HighKnown Malware Source Similarityexamples/extensions/notify.ts
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
HighKnown Malware Source Similarityexamples/extensions/github-issue-autocomplete.ts
MediumNetwork
Medium
Affected versions and remediation
This report applies to @leanandmean/coding-agent@0.74.1-scramjet.58.
See all versions of @leanandmean/coding-agent for other recorded verdicts.
- Review the evidence and your use of @leanandmean/coding-agent@0.74.1-scramjet.58 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.