registry / @peapodtech/peapodos / 0.2.1

@peapodtech/peapodos@0.2.1

Main software for PeaPod.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

When the dashboard mode is enabled, an unauthenticated Socket.IO client can register a linker expression. A later microcontroller message matching the chosen label causes server-side `eval` execution.

Static reason

No blocking static signals were detected.

Trigger

Start the dashboard on an accessible interface, connect to Socket.IO, submit `linker-post`, then wait for or induce matching controller data.

Impact

Remote code execution with the privileges of the PeaPodOS server process.

Mechanism

Unauthenticated Socket.IO input reaches delayed `eval`.

Rationale

The package is not malicious by source intent, but it contains a concrete unauthenticated remote-code-execution path in its dashboard runtime. Flag it as a warning until the eval-based linker and unauthenticated exposure are removed or strongly constrained.

Evidence

index.mjsserver.mjsapi/firebase.mjs.env.templatepackage.json

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`index.mjs:662` evaluates attacker-controlled linker expressions with `eval`.

@peapodtech/peapodos@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code