registry / @punks/cli / 4.0.0
@punks/cli@4.0.0
⚠ Under reviewHarness Intelligence scaffolding CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspectable package text shows a user-invoked CLI without an install hook, but the required baseline archive is unreadable binary, so a clean citation of its contents cannot be completed. That inspection gap is not itself proof of an attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No install trigger was found. The archive would matter only if a later user scaffold command extracts it.
Impact
No confirmed credential theft, remote payload, or install-time agent-control write. Archive contents remain unread.
Mechanism
Text sources call git or an npm registry version lookup after the user runs the CLI or a helper. The tarball could not be decoded as source.
AI rationale
Inspectable package text shows a user-invoked CLI without an install hook, but the required baseline archive is unreadable binary, so a clean citation of its contents cannot be completed. That inspection gap is not itself proof of an attack.
Evidence
dist/baseline/scaffold-baseline.tgz
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json publishes user bins hi and hint at dist/index.js and has build, test, and release scripts, with no preinstall, install, or postinstall hook.
- dist/index.js starts as a node CLI and is reached when a person runs hi or hint, not during package install.
- The format hook shells out only to git with the hook's arguments when that script is executed.
- The timesheet helper is a standalone script that reads local git history after the caller supplies month, authors, and a repo map.
- dist/baseline/scaffold-baseline.tgz is a binary archive the CLI names as the scaffold baseline, and its bytes could not be read as source, so the archive contents stay unverified.
Evidence against
- Inspectable CLI and helper scripts limit git, file writes, and the npm registry version lookup to user-run commands or later hook scripts.
- No readable entrypoint shows install-time execution, credential export, or a foreign agent-control write.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
12 flaggeddist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from "node:child_process";
L3: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView on unpkg · L1dist/index.jsView file
151`)return yield*this.pushCount(1);else if(ch==="\r"&&this.charAt(1)===`
L152: `)return yield*this.pushCount(2);else return 0}*pushSpaces(allowTabs){let i=this.pos-1;let ch;do{ch=this.buffer[++i]}while(ch===" "||allowTabs&&ch==="\t");const n=i-this.pos;if(n>0...
L153: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
...
L155: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
High
Findings
1 Critical8 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/baseline/scaffold-baseline/data/hooks/format-edited-file.mjs
HighChild Processdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjs
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighShips High Entropy Blobdist/baseline/scaffold-baseline.tgz
MediumUnsafe Vm Contextdist/index.js
MediumNetwork
Affected versions and remediation
This report applies to @punks/cli@4.0.0.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@4.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.