registry / @punks/cli / 5.2.0
@punks/cli@5.2.0
Harness Intelligence scaffolding CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source supports a guarded, first-party agent-extension setup capability, not malware or covert exfiltration. Its project-level Codex hook mutation is concrete enough for a non-blocking warning.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running the CLI's scaffold or update workflow.
Impact
This can extend the target project's Codex control surface, so it warrants a warning despite no confirmed malicious behavior.
Mechanism
The bundled CLI constructs lifecycle-hook entries for .codex/config.toml and applies them as scaffold output; it also queries the npm registry for version checks.
AI rationale
The source supports a guarded, first-party agent-extension setup capability, not malware or covert exfiltration. Its project-level Codex hook mutation is concrete enough for a non-blocking warning.
Evidence
dist/index.js.codex/config.toml
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes the dist CLI through hi and hint, with no npm install lifecycle hook.
- The CLI builds and applies Codex lifecycle-hook configuration targeting .codex/config.toml in the project it scaffolds.
- The CLI checks its own version against the npm registry during execution.
Evidence against
- No credential harvesting, exfiltration sink, hidden payload execution, or install-time hook was identified in the inspected paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicenseWildcardDependency
Source & flagged code
19 flaggeddist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from "node:child_process";
L3: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView on unpkg · L1dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @punks/cli@5.0.1
matchedIdentity = npm:QHB1bmtzL2NsaQ:5.0.1
similarity = 0.933
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgFindings
1 Critical14 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjs
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighShips High Entropy Blobdist/baseline/scaffold-baseline.tgz
HighKnown Malware Source Similaritydist/baseline/scaffold-baseline/skills/frameworks/expo/expo-skill-eval/scripts/snapshot-android.sh
Affected versions and remediation
This report applies to @punks/cli@5.2.0.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@5.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.