registry  /  @pimmesz/afterburner  /  2.17.1

@pimmesz/afterburner@2.17.1

Convert idle AI-subscription quota (Claude or Codex) into shippable engineering work: budget-aware trigger, bounded task selection, PR-only output.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Risky primitives are user-invoked and aligned with an AI quota automation CLI that runs local agents, schedules jobs, and sends configured notifications.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs afterburner CLI commands such as auth, init, run-once, schedule install, statusline install, notify, or update.
Impact
Can execute user-configured agents/commands against configured repos and write local config/scheduler files when explicitly requested.
Mechanism
User-configured local agent automation with optional scheduler and notifications
Rationale
Static inspection found high-risk capabilities, but they are documented, user-invoked CLI features for the package's stated purpose rather than install-time/import-time credential theft, exfiltration, or covert persistence. No concrete malicious behavior was identified.
Evidence
package.jsondist/cli/index.jsdist/chunk-WJGGV2YJ.jsREADME.mdskill/SKILL.md~/.claude/settings.json~/.claude.json~/.config/systemd/user~/Library/LaunchAgents~/.zshrc~/.bashrc
Network endpoints3
registry.npmjs.orgntfy.shapi.telegram.org

Decision evidence

public snapshot
AI called this Clean at 87.0% confidence as Benign with medium false-positive risk.
Evidence for block
    Evidence against
    • package.json has no install/postinstall lifecycle hooks; CLI is only bin/main entrypoint.
    • dist/cli/index.js auth runs `claude setup-token` only under explicit `afterburner auth` and stores token locally.
    • Network use is package-aligned: npm update check, ntfy/Telegram notifications, npm registry lookup.
    • Scheduler/statusline persistence is explicit user-invoked setup, with prompts/backups, not install-time mutation.
    • Agent and verify command execution is core documented functionality for running user-configured repos/tasks.
    • README.md discloses no telemetry and describes local agent, scheduler, notification, and PR workflow.
    Behavioral surface
    Source
    ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
    Supply chain
    HighEntropyStringsUrlStrings
    ManifestNo manifest risk signals triggered.
    scanned 4 file(s), 419 KB of source, external domains: api.telegram.org, crontab.guru, git-scm.com, github.com, nodejs.org, ntfy.sh, registry.npmjs.org, www.apple.com

    Source & flagged code

    7 flagged · loading source
    dist/cli/index.jsView file
    70L71: // package.json L72: var package_default = { ... L117: type: "git", L118: url: "git+https://github.com/pimmesz/afterburner.git" L119: }, ... L156: // src/cli/ui.ts L157: var noColor = !!process.env.NO_COLOR || process.env.TERM === "dumb"; L158: var fancy = process.stdout.isTTY === true && !noColor; L159: var fancyErr = process.stderr.isTTY === true && !noColor; L160: var canAnimate = fancyErr && !process.env.CI; L161: var paint = (enabled) => (open2, close) => (s) => enabled ? `\x1B[${open2}m${s}\x1B[${close}m` : s;
    Critical
    Command Output Exfiltration

    Source executes local commands and sends command output to an external endpoint.

    dist/cli/index.jsView on unpkg · L70
    70Trigger-reachable chain: manifest.bin -> dist/cli/index.js L70: L71: // package.json L72: var package_default = { ... L117: type: "git", L118: url: "git+https://github.com/pimmesz/afterburner.git" L119: }, ... L156: // src/cli/ui.ts L157: var noColor = !!process.env.NO_COLOR || process.env.TERM === "dumb"; L158: var fancy = process.stdout.isTTY === true && !noColor; L159: var fancyErr = process.stderr.isTTY === true && !noColor; L160: var canAnimate = fancyErr && !process.env.CI; L161: var paint = (enabled) => (open2, close) => (s) => enabled ? `\x1B[${open2}m${s}\x1B[${close}m` : s;
    Critical
    Trigger Reachable Dangerous Capability

    A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

    dist/cli/index.jsView on unpkg · L70
    326// src/cli/commands/auth.ts L327: import { spawn } from "child_process"; L328: import { createInterface } from "readline";
    High
    Child Process

    Package source references child process execution.

    dist/cli/index.jsView on unpkg · L326
    3084if (platform === "win32") { L3085: return { name: "notify", ok: true, detail: "desktop banners via PowerShell toast" }; L3086: }
    High
    Shell

    Package source references shell execution.

    dist/cli/index.jsView on unpkg · L3084
    3084if (platform === "win32") { L3085: return { name: "notify", ok: true, detail: "desktop banners via PowerShell toast" }; L3086: } ... L3094: function checkNtfy(config) { L3095: const hasToken = !!process.env.AFTERBURNER_NTFY_TOKEN; L3096: const server = config.notify.ntfy.server; L3097: if (hasToken && !server.startsWith("https://")) { L3098: return {
    High
    Same File Env Network Execution

    A single source file combines environment access, network access, and code or shell execution; review context before blocking.

    dist/cli/index.jsView on unpkg · L3084
    2943const results = []; L2944: const version = spawnSync("claude", ["--version"], { encoding: "utf8" }); L2945: if (version.status !== 0) { ... L2949: detail: "claude-code engine selected but the `claude` CLI is not on PATH", L2950: fix: "Install Claude Code: `npm install -g @anthropic-ai/claude-code`, then run `claude /login`." L2951: });
    High
    Runtime Package Install

    Package source invokes a package manager install command at runtime.

    dist/cli/index.jsView on unpkg · L2943
    70L71: // package.json L72: var package_default = { ... L117: type: "git", L118: url: "git+https://github.com/pimmesz/afterburner.git" L119: }, ... L156: // src/cli/ui.ts L157: var noColor = !!process.env.NO_COLOR || process.env.TERM === "dumb"; L158: var fancy = process.stdout.isTTY === true && !noColor; L159: var fancyErr = process.stderr.isTTY === true && !noColor; L160: var canAnimate = fancyErr && !process.env.CI; L161: var paint = (enabled) => (open2, close) => (s) => enabled ? `\x1B[${open2}m${s}\x1B[${close}m` : s;
    Medium
    Install Persistence

    Source writes installer persistence such as shell profile or service configuration.

    dist/cli/index.jsView on unpkg · L70

    Findings

    2 Critical4 High4 Medium4 Low
    CriticalCommand Output Exfiltrationdist/cli/index.js
    CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js
    HighChild Processdist/cli/index.js
    HighShelldist/cli/index.js
    HighSame File Env Network Executiondist/cli/index.js
    HighRuntime Package Installdist/cli/index.js
    MediumNetwork
    MediumEnvironment Vars
    MediumInstall Persistencedist/cli/index.js
    MediumStructural Risk Force Deep Review
    LowScripts Present
    LowFilesystem
    LowHigh Entropy Strings
    LowUrl Strings