registry / @pimmesz/afterburner / 2.15.0

@pimmesz/afterburner@2.15.0

Convert idle AI-subscription quota (Claude or Codex) into shippable engineering work: budget-aware trigger, bounded task selection, PR-only output.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The risky primitives are explicit CLI features for an AI-agent automation tool and are not activated at install or import time.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs afterburner commands such as init, run-once, auth, schedule install, notify setup/test, statusline install, or update.

Impact

Can modify configured repositories, local config/scheduler files, or send notifications when the user opts in; no stealth execution or exfiltration was confirmed.

Mechanism

User-invoked local automation, scheduling, notifications, and package self-update.

Rationale

Static inspection shows a high-capability CLI for deliberately running local Claude/Codex automation, scheduling it, and sending optional notifications, but the behavior is documented, user-invoked, and absent from lifecycle/import-time paths. Scanner findings map to package-aligned functionality rather than unconsented credential theft, persistence, or exfiltration.

Evidence

package.jsondist/cli/index.jsdist/chunk-K34TPJGR.jsdist/core/index.jsREADME.md.env.exampleskill/SKILL.mdafterburner.config.example.tsafterburner.config.mjs~/.config/systemd/user/afterburner.service~/.config/systemd/user/afterburner.timer~/Library/LaunchAgents/io.afterburner.run-once.plist~/.zshrc~/.bashrc~/.claude/skills/afterburner/

Network endpoints3

registry.npmjs.orgntfy.shapi.telegram.org

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/cli/index.js exposes user-invoked live AI-agent automation that can spawn claude/codex and run configured verify/setup commands.
dist/cli/index.js has opt-in schedule/statusline installers that write launchd/systemd/shell rc artifacts.
dist/cli/index.js update command runs a package-manager command with shell:true, but only under explicit afterburner update.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; main only re-exports core APIs.
README.md describes the same agent, schedule, auth, update, ntfy, and Telegram behavior as product features.
dist/cli/index.js auth runs claude setup-token only on explicit auth and stores locally via writeOAuthToken, not to a remote endpoint.
dist/chunk-K34TPJGR.js notification endpoints are user-configured ntfy/Telegram pushes with HTTPS token checks, not broad data harvesting.
dist/chunk-K34TPJGR.js passes untrusted task/issue text via env/stdin and documents prompt-injection defenses.
.env.example warns secrets are env-only and strips API keys from child agent processes.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 413 KB of source, external domains: api.telegram.org, crontab.guru, git-scm.com, github.com, nodejs.org, ntfy.sh, registry.npmjs.org, www.apple.com

Source & flagged code

7 flagged

dist/cli/index.jsView file

Lines 50-90javascript

50 readUsageCache,

51 reapOrphanWorktrees,

52 runInteractiveTurn,

53 runOnce,

54 sanitizeCodexEnv,

55 sanitizeSpawnEnv,

56 sanitizeTitle,

57 scheduleArmedState,

58 scheduleArtifactPaths,

59 scheduleStopCommands,

60 shouldIgnite,

61 spawnAgentProcess,

62 startWatch,

63 withGoalPlanner,

64 writeOAuthToken,

65 writeUsageCache

66} from "../chunk-K34TPJGR.js";

68// src/cli/index.ts

69import { Command } from "commander";

71// package.json

72var package_default = {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli/index.jsView on unpkg · L70

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L70

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L70

73 name: "@pimmesz/afterburner",

74 version: "2.15.0",

75 description: "Convert idle AI-subscription quota (Claude or Codex) into shippable engineering work: budget-aware trigger, bounded task selection, PR-only output.",

76 license: "Apache-2.0",

77 publishConfig: {

78 access: "public"

79 },

80 type: "module",

81 packageManager: "pnpm@11.5.3",

82 engines: {

83 node: ">=22.12"

84 },

85 bin: {

86 afterburner: "dist/cli/index.js",

87 abr: "dist/cli/index.js"

88 },

89 main: "./dist/core/index.js",

90 types: "./dist/core/index.d.ts",

Lines 306-346javascript

306 if (!fancy || process.env.CI) {

307 console.log(banner());

308 return;

309 }

310 const jet = `${emoji.jet} `;

311 for (let pos

Lines 2923-2963javascript

2923 if (process.env[key]) {

2924 results2.push({

2925 name: "env",

2926 ok: false,

2927 detail: `${key} is set: with \`codex exec\` it bills the metered OpenAI API instead of spending subscription quota`,

2928 fix: `unset ${key} (Afterburner also strips it from child processes as a defense, but fix the environment).`

2929 });

2930 }

Lines 3064-3104javascript

3064 const has = deps.has ?? commandExistsSync;

3065 if (platform === "darwin") {

3066 return has("terminal-notifier") ? {

3067 name: "notify",

3068 ok: true,

3069 detail: "desktop banners via terminal-notifier (clickable PR links)"

Source & flagged code

7 flagged · loading source

dist/cli/index.jsView file

70L71: // package.json L72: var package_default = { ... L117: type: "git", L118: url: "git+https://github.com/pimmesz/afterburner.git" L119: }, ... L156: // src/cli/ui.ts L157: var noColor = !!process.env.NO_COLOR || process.env.TERM === "dumb"; L158: var fancy = process.stdout.isTTY === true && !noColor; L159: var fancyErr = process.stderr.isTTY === true && !noColor; L160: var canAnimate = fancyErr && !process.env.CI; L161: var paint = (enabled) => (open2, close) => (s) => enabled ? `\x1B[${open2}m${s}\x1B[${close}m` : s;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli/index.jsView on unpkg · L70

70Trigger-reachable chain: manifest.bin -> dist/cli/index.js L70: L71: // package.json L72: var package_default = { ... L117: type: "git", L118: url: "git+https://github.com/pimmesz/afterburner.git" L119: }, ... L156: // src/cli/ui.ts L157: var noColor = !!process.env.NO_COLOR || process.env.TERM === "dumb"; L158: var fancy = process.stdout.isTTY === true && !noColor; L159: var fancyErr = process.stderr.isTTY === true && !noColor; L160: var canAnimate = fancyErr && !process.env.CI; L161: var paint = (enabled) => (open2, close) => (s) => enabled ? `\x1B[${open2}m${s}\x1B[${close}m` : s;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L70

326// src/cli/commands/auth.ts L327: import { spawn } from "child_process"; L328: import { createInterface } from "readline";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L326

3084if (platform === "win32") { L3085: return { name: "notify", ok: true, detail: "desktop banners via PowerShell toast" }; L3086: }

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L3084

3084if (platform === "win32") { L3085: return { name: "notify", ok: true, detail: "desktop banners via PowerShell toast" }; L3086: } ... L3094: function checkNtfy(config) { L3095: const hasToken = !!process.env.AFTERBURNER_NTFY_TOKEN; L3096: const server = config.notify.ntfy.server; L3097: if (hasToken && !server.startsWith("https://")) { L3098: return {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L3084

2943const results = []; L2944: const version = spawnSync("claude", ["--version"], { encoding: "utf8" }); L2945: if (version.status !== 0) { ... L2949: detail: "claude-code engine selected but the `claude` CLI is not on PATH", L2950: fix: "Install Claude Code: `npm install -g @anthropic-ai/claude-code`, then run `claude /login`." L2951: });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L2943

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L70

Findings

2 Critical4 High4 Medium4 Low

CriticalCommand Output Exfiltrationdist/cli/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js

HighChild Processdist/cli/index.js

HighShelldist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/cli/index.jsView file

Lines 50-90javascript

50 readUsageCache,

51 reapOrphanWorktrees,

52 runInteractiveTurn,

53 runOnce,

54 sanitizeCodexEnv,

55 sanitizeSpawnEnv,

56 sanitizeTitle,

57 scheduleArmedState,

58 scheduleArtifactPaths,

59 scheduleStopCommands,

60 shouldIgnite,

61 spawnAgentProcess,

62 startWatch,

63 withGoalPlanner,

64 writeOAuthToken,

65 writeUsageCache

66} from "../chunk-K34TPJGR.js";

68// src/cli/index.ts

69import { Command } from "commander";

71// package.json

72var package_default = {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli/index.jsView on unpkg · L70

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L70

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L70

73 name: "@pimmesz/afterburner",

74 version: "2.15.0",

75 description: "Convert idle AI-subscription quota (Claude or Codex) into shippable engineering work: budget-aware trigger, bounded task selection, PR-only output.",

76 license: "Apache-2.0",

77 publishConfig: {

78 access: "public"

79 },

80 type: "module",

81 packageManager: "pnpm@11.5.3",

82 engines: {

83 node: ">=22.12"

84 },

85 bin: {

86 afterburner: "dist/cli/index.js",

87 abr: "dist/cli/index.js"

88 },

89 main: "./dist/core/index.js",

90 types: "./dist/core/index.d.ts",

Lines 306-346javascript

306 if (!fancy || process.env.CI) {

307 console.log(banner());

308 return;

309 }

310 const jet = `${emoji.jet} `;

311 for (let pos

Lines 2923-2963javascript

2923 if (process.env[key]) {

2924 results2.push({

2925 name: "env",

2926 ok: false,

2927 detail: `${key} is set: with \`codex exec\` it bills the metered OpenAI API instead of spending subscription quota`,

2928 fix: `unset ${key} (Afterburner also strips it from child processes as a defense, but fix the environment).`

2929 });

2930 }

Lines 3064-3104javascript

3064 const has = deps.has ?? commandExistsSync;

3065 if (platform === "darwin") {

3066 return has("terminal-notifier") ? {

3067 name: "notify",

3068 ok: true,

3069 detail: "desktop banners via terminal-notifier (clickable PR links)"