registry / @missing-ai-patterns/cli / 0.5.0

@missing-ai-patterns/cli@0.5.0

MAP CLI — initialize an AI-architecture workspace, analyze a codebase, and adopt Missing AI Patterns.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

No install-time attack behavior is present. An untrusted downloaded registry can supply traversal paths later written by explicit `map add`.

Static reason

No blocking static signals were detected.

Trigger

User runs `map update` against a malicious/compromised registry, then runs `map add` for its entry.

Impact

Potential arbitrary file write outside the .map workspace; no automatic execution is established.

Mechanism

Unvalidated remote registry paths flow into filesystem writes.

Rationale

The package is not malicious as shipped, but its remote-registry-to-write-path flow is an unresolved security flaw with a plausible arbitrary-file-write impact.

Evidence

package.jsondist/map.jsdist/chunk-2MTB73PN.jsregistry-snapshot/registry.json

Network endpoints1

github.com/missing-ai-patterns/map/releases/latest/download/registry.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

@missing-ai-patterns/cli@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code