registry / Remote code execution / @noctrodex/sast / 1.0.0-rc13.2

@noctrodex/sast@1.0.0-rc13.2

NOCTRODEX(GHOSTMASTER) SAST thin client — browser login, auth and licence; fetches the verified host-side engine (Nuitka-obfuscated, self-contained runtime) and uses colibri as its only local AI backend. The engine runs on your own host and scans from you

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The inspected source shows a user-invoked launcher for an opaque remote engine and an automatic Windows certificate trust change. These are consequential capabilities, but the source does not verify an active attack, so a warning is appropriate.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the package's CLI, including its setup command.

Impact

The engine receives execution on the host, and the certificate trust change broadens which software can be trusted for that user. No data theft or other concrete attack was established from the inspected JavaScript.

Mechanism

The launcher resolves a cached or remote engine, verifies downloaded archives, then starts the engine. Its Windows trust helper adds the engine certificate to Root and TrustedPeople.

AI rationale

Evidence

bin/noctrodex-sast.jslib/engine-fetch.jspackage.json

Network endpoints2

noctrodex-engines.soumabha-majumdar.workers.dev/sastmcp.noctrodex-hq.com

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package describes itself as a thin SAST client that fetches and runs a host-side engine.
The CLI resolves an engine and spawns it when the user runs the command.
The launcher downloads an engine from its configured bucket and checks the archive size and SHA-256 before installation.
On Windows, the launcher adds the engine certificate to the current user's Root and TrustedPeople certificate stores.

Evidence against

The engine token is attached only when the request shares the bucket's origin.
The package has no lifecycle script; engine setup and execution are initiated through the CLI.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 33.1 KB of source, external domains: 127.0.0.1, github.com, mcp.noctrodex-hq.com, noctrodex-engines.soumabha-majumdar.workers.dev

Source & flagged code

5 flagged

bin/noctrodex-sast.jsView file

15"use strict"; L16: const { spawn } = require("child_process"); L17: const { resolveEngine } = require("../lib/engine-fetch");

High

Child Process

Package source references child process execution.

bin/noctrodex-sast.jsView on unpkg · L15

lib/engine-fetch.jsView file

29const crypto = require("crypto"); L30: const { spawnSync } = require("child_process"); L31: const zip = require("./zip"); ... L33: L34: const ENGINE_BASE_URL_DEFAULT = "https://noctrodex-engines.soumabha-majumdar.workers.dev/sast"; L35: ... L38: function engineApi() { L39: return (process.env.NOCTRODEX_ENGINE_API || process.env.NOCTRODEX_CORPUS_WORKER_URL || L40: "https://mcp.noctrodex-hq.com").replace(/\/$/, "");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/engine-fetch.jsView on unpkg · L29

Findings

5 High3 Medium4 Low

HighChild Processbin/noctrodex-sast.js

HighSame File Env Network Executionlib/engine-fetch.js

HighCommand Output Exfiltrationlib/colibri.js

HighSandbox Evasion Gated Capabilitylib/engine-fetch.js

HighTrigger Reachable Command Output Exfiltrationlib/colibri.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @noctrodex/sast@1.0.0-rc13.2.

See all versions of @noctrodex/sast for other recorded verdicts.

Review the evidence and your use of @noctrodex/sast@1.0.0-rc13.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 15:36:42.182Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Remote code execution / @noctrodex/sast / 1.0.0-rc13.2

@noctrodex/sast@1.0.0-rc13.2

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the package's CLI, including its setup command.

Impact

Mechanism

The launcher resolves a cached or remote engine, verifies downloaded archives, then starts the engine. Its Windows trust helper adds the engine certificate to Root and TrustedPeople.

AI rationale

Evidence

bin/noctrodex-sast.jslib/engine-fetch.jspackage.json

Network endpoints2

noctrodex-engines.soumabha-majumdar.workers.dev/sastmcp.noctrodex-hq.com

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package describes itself as a thin SAST client that fetches and runs a host-side engine.
The CLI resolves an engine and spawns it when the user runs the command.
The launcher downloads an engine from its configured bucket and checks the archive size and SHA-256 before installation.
On Windows, the launcher adds the engine certificate to the current user's Root and TrustedPeople certificate stores.

Evidence against

The engine token is attached only when the request shares the bucket's origin.
The package has no lifecycle script; engine setup and execution are initiated through the CLI.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 33.1 KB of source, external domains: 127.0.0.1, github.com, mcp.noctrodex-hq.com, noctrodex-engines.soumabha-majumdar.workers.dev

Source & flagged code

5 flagged

bin/noctrodex-sast.jsView file

15"use strict"; L16: const { spawn } = require("child_process"); L17: const { resolveEngine } = require("../lib/engine-fetch");

High

Child Process

Package source references child process execution.

bin/noctrodex-sast.jsView on unpkg · L15

lib/engine-fetch.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/engine-fetch.jsView on unpkg · L29

Findings

5 High3 Medium4 Low

HighChild Processbin/noctrodex-sast.js

HighSame File Env Network Executionlib/engine-fetch.js

HighCommand Output Exfiltrationlib/colibri.js

HighSandbox Evasion Gated Capabilitylib/engine-fetch.js

HighTrigger Reachable Command Output Exfiltrationlib/colibri.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @noctrodex/sast@1.0.0-rc13.2.

See all versions of @noctrodex/sast for other recorded verdicts.

Review the evidence and your use of @noctrodex/sast@1.0.0-rc13.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 15:36:42.182Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.