registry / @milpa/comal / 0.2.1
@milpa/comal@0.2.1
Comal: governed operations, execution receipts, and programming assistance in any language
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential flows are provider requests constrained to the selected service origin, and the Unicode finding points to code that strips invisible controls. The reviewed entry points and relay operations show no concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI startup or explicit plugin activation and provider use.
Impact
No malicious impact found in the reviewed paths.
Mechanism
Provider credentials are constrained to the configured provider origin; relay operations use a local administrative socket with method restrictions and confirmation for mutations.
AI rationale
The flagged credential flows are provider requests constrained to the selected service origin, and the Unicode finding points to code that strips invisible controls. The reviewed entry points and relay operations show no concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI binaries and declares no lifecycle scripts.
- The CLI sends subscription credentials only to the selected provider's origin; it rejects a different origin.
- Provider profiles require an explicitly configured HTTP(S) base URL and store environment variable names rather than API keys.
- The open-relay client restricts operations to listed reads and mutations requiring a human confirmation card.
- The flagged invisible Unicode characters are in a sanitizer that replaces control and bidirectional characters.
Evidence against
- The package uses network access and environment variables to connect to configured AI providers; this matches its CLI purpose.
- The open-relay plugin starts a watcher when activated unless its notify setting is off.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
7 flaggednode_modules/ajv/dist/compile/jtd/serialize.jsView file
49sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`;
L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
L51: const serialize = makeSerialize(this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/ajv/dist/compile/jtd/serialize.jsView on unpkg · L49node_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.jsView file
2Object.defineProperty(exports, "__esModule", { value: true });
L3: const dynamicAnchor_1 = require("./dynamicAnchor");
L4: const util_1 = require("../../compile/util");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
node_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.jsView on unpkg · L2Findings
2 Critical1 High6 Medium5 Low
CriticalTrojan Source Unicodesrc/plugins/open-relay/bound.mjs
CriticalTrigger Reachable Dangerous Capabilitysrc/plugin-notices.mjs
HighSemantic Analysis Limitednode_modules/ajv/dist/runtime/parseJson.js#virtual:normalized:round1
MediumDynamic Requirenode_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulenode_modules/@jitl/quickjs-wasmfile-debug-asyncify/dist/emscripten-module.wasm
MediumShips Build Helpersrc/windows-private.ps1
MediumStructural Risk Force Deep Review
LowEvalnode_modules/ajv/dist/compile/jtd/serialize.js
LowFilesystem
Low
Affected versions and remediation
This report applies to @milpa/comal@0.2.1.
See all versions of @milpa/comal for other recorded verdicts.
- Review the evidence and your use of @milpa/comal@0.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.