registry / @markus-global/cli / 0.11.3
@markus-global/cli@0.11.3
⚠ Under reviewMarkus — AI Digital Workforce Platform
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe inspected manifest and source show no install-time attack, and the reviewed network behavior appears package-aligned. The browser extension archive could not be inspected, so its contents remain unresolved.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Unknown; the archive contents were unreadable during inspection.
Impact
No confirmed impact; the archive leaves an unresolved inspection gap.
Mechanism
No behavior could be established from the archive.
AI rationale
The inspected manifest and source show no install-time attack, and the reviewed network behavior appears package-aligned. The browser extension archive could not be inspected, so its contents remain unresolved.
Decision evidence
public snapshotAI called this Manual Review at 56.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The shipped browser extension archive could not be inspected as text, leaving its contents unverified.
- The package includes a large minified UI bundle that could not be fully inspected within the available excerpt.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The update command points to Markus’s GitHub release host.
- The inspected UI request sends its token to the configured proxy base path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
13 flaggeddist/utils/browser.jsView file
4*/
L5: import { exec } from 'node:child_process';
L6: import { get as httpGet } from 'node:http';
High
Child Process
Package source references child process execution.
dist/utils/browser.jsView on unpkg · L44*/
L5: import { exec } from 'node:child_process';
L6: import { get as httpGet } from 'node:http';
L7: import { platform } from 'node:os';
L8: export function openBrowser(url) {
L9: if (process.env['NO_BROWSER'])
L10: return;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/utils/browser.jsView on unpkg · L4dist/commands/update.jsView file
40stdio: 'inherit',
L41: shell: true,
L42: });
High
Shell
Findings
7 High7 Medium7 Low
HighChild Processdist/utils/browser.js
HighShelldist/commands/update.js
HighSame File Env Network Executiondist/utils/browser.js
HighShips High Entropy Blobdist/markus-browser-extension.zip
HighSemantic Analysis Limiteddist/web-ui/assets/DeliverableShareModal-CBSvxB-X.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/web-ui/assets/chunk-AQP2D5EJ-FymM7gfT.js
HighPrevious Version Dangerous Deltadist/commands/start.js
MediumDynamic Requiredist/web-ui/assets/viz-global-C_AyN6D9.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/markus-browser-extension.zip
Medium
Affected versions and remediation
This report applies to @markus-global/cli@0.11.3.
See all versions of @markus-global/cli for other recorded verdicts.
- Review the evidence and your use of @markus-global/cli@0.11.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.